The Agent Skills Directory

[COMMAND_EXECUTION]: The skill utilizes local shell commands to facilitate its auditing process. The scripts/generate_rank_input.py script executes git diff via subprocess.run to accurately identify changed files during diff-scoped scans. This is a standard functional requirement for source code auditing.
[DYNAMIC_EXECUTION]: Several components of the skill use dynamic loading and low-level system APIs for legitimate functional purposes. The scripts/finalize_scan_contract.py script uses importlib to load local modules for report projection. Additionally, scripts/windows_scan_local_files.py utilizes ctypes and dynamic imports to access Win32 APIs, providing secure file operations and preventing path-traversal attacks on Windows systems.
[INDIRECT_PROMPT_INJECTION]: As a security scanner, the skill is designed to ingest and process arbitrary source code from repositories and pull requests. This inherently exposes a surface where untrusted data could contain instructions meant to influence the agent's behavior. The skill addresses this risk by providing a strict, phase-based operational sequence and using deterministic scripts to handle data inventory and report generation.
[SAFE]: The skill incorporates several security best practices, including a mandatory approval gate before performing token-heavy model tasks, rigorous path sanitization in finalize_scan_contract.py and windows_scan_local_files.py, and the use of JSON schemas to ensure the integrity of scan artifacts.

security-scan