The Agent Skills Directory

[REMOTE_CODE_EXECUTION]: The skill includes instructions to download and execute installation scripts for security tools directly from their official GitHub repositories, specifically for Gitleaks, TruffleSecurity, and Anchore (Syft/Grype). These are well-known and industry-standard security organizations. The skill mitigates risks associated with piped execution by implementing a mandatory human-in-the-loop checkpoint, instructing the agent to always ask the user for permission before any tool installation.
[COMMAND_EXECUTION]: The skill uses shell scripts to automate project audits, such as dependency scanning and configuration validation. It identifies the technology stack of the target project (e.g., Node.js, Python, Go, Rust) and executes appropriate local auditing tools. All execution is scoped to the target project directory and intended for security hardening purposes.
[INDIRECT_PROMPT_INJECTION]: The skill processes untrusted data from local project files (e.g., package manifests, configuration files) to generate findings in a security report.
Ingestion points: Local project files are read by scripts/check-config.sh, scripts/scan-secrets.sh, and scripts/audit-dependencies.sh.
Boundary markers: The skill uses clear logical steps and mandates user consent before interacting with external software or performing installations.
Capability inventory: The skill has the capability to execute shell commands, read/write files, and create directories for reports (docs/reports).
Sanitization: External data is processed via established, specialized security scanners (Gitleaks, Grype, Syft) which provide structured output, reducing the risk of accidental instruction following from processed data.

production-ready