The Agent Skills Directory

[COMMAND_EXECUTION]: The skill utilizes the Bash tool to execute various shell commands, including grep, cat, npm audit, and pip audit. These commands are strictly mapped to its primary purpose of discovering security vulnerabilities, misconfigurations, and outdated dependencies within a target codebase.
[INDIRECT_PROMPT_INJECTION]: The skill possesses a vulnerability surface for indirect prompt injection as it processes untrusted source code and configuration files from the user's project to generate reports.
Ingestion points: The skill reads project configuration files (e.g., package.json, pyproject.toml) and source code files within the src/ and app/ directories.
Boundary markers: The instructions do not define explicit boundary markers or delimiters for the data being ingested.
Capability inventory: The skill has access to the Bash tool for running analysis commands and the Read tool for file access.
Sanitization: There is no evidence of sanitization or filtering of the ingested source code content before it is processed by the agent to generate the final report.

pentest-report