The Agent Skills Directory

[COMMAND_EXECUTION]: The skill instructs the agent to use standard ecosystem command-line tools (e.g., npm audit, pnpm audit, pip-audit, cargo audit, composer audit) to retrieve vulnerability data and dependency trees. These commands are fundamental to the skill's stated purpose of dependency auditing.
[EXTERNAL_DOWNLOADS]: The instructions involve downloading and installing auditing utilities from well-known sources. For example, it suggests installing govulncheck and go-licenses from Google's official repositories and using osv-scanner (an open-source vulnerability scanner from Google). These references target established organizations and are documented neutrally as part of the audit workflow.
[INDIRECT_PROMPT_INJECTION]: The skill acts as a processing engine for untrusted data, specifically lockfiles (package-lock.json, Cargo.lock, go.mod) and registry metadata. It addresses this by requiring the agent to parse structured JSON output from tools and adhere to strict evidence tiers, which reduces the risk of the agent being misled by malicious descriptions or metadata in third-party packages.

dependency-audit