The Agent Skills Directory

[EXTERNAL_DOWNLOADS]: The github-actions-template.yml and assets/github-actions-template.yml files include commands to download supporting scripts and rulesets from a remote repository.
Evidence: curl -o scripts/parse_spectral_results.py https://raw.githubusercontent.com/SecOpsAgentKit/skills/main/appsec/api-spectral/scripts/parse_spectral_results.py in assets/github-actions-template.yml.
[REMOTE_CODE_EXECUTION]: The CI configuration template provides an example of installing the tfsec security tool by piping a remote installation script directly into a shell interpreter.
Evidence: curl -s https://raw.githubusercontent.com/aquasecurity/tfsec/master/scripts/install_linux.sh | bash in assets/ci-config-template.yml.
[COMMAND_EXECUTION]: The skill instructions and templates rely on the execution of the spectral CLI tool and various package managers (npm, yarn) to perform its primary function.
Evidence: Multiple instances of spectral lint and npm install -g @stoplight/spectral-cli across SKILL.md and CI templates.
[PROMPT_INJECTION]: The skill presents an attack surface for indirect prompt injection, as it is designed to ingest and analyze external API specifications which may contain attacker-controlled content in descriptions or examples.
Ingestion points: API specification files (OpenAPI, AsyncAPI, Arazzo) processed in SKILL.md via spectral lint.
Boundary markers: None identified.
Capability inventory: Shell execution of spectral and results parsing scripts.
Sanitization: None identified.

api-spectral