The Agent Skills Directory

[SAFE]: The skill provides documentation for 'trivy', a legitimate open-source security tool maintained by Aqua Security. All commands and examples are standard usage patterns for vulnerability, secret, and misconfiguration scanning.
[COMMAND_EXECUTION]: The skill contains numerous examples of shell commands (e.g., trivy image, trivy fs). These are documented for the agent to use as a tool for scanning local environments, Docker images, and Git repositories, which is the intended and primary purpose of the skill.
[REMOTE_CODE_EXECUTION]: One example in references/container-security.md shows a 'Bad' Dockerfile pattern (RUN curl https://example.com/install.sh | bash) as a warning to users about supply chain attacks. This is educational content and does not represent an actual execution path for the skill itself.
[DATA_EXFILTRATION]: While the tool accesses filesystems and repositories to perform scans, there are no patterns suggesting data is being exfiltrated to unauthorized third-party servers. The documented network operations are for downloading vulnerability databases from official sources or scanning remote repositories as requested by the user.

trivy