The Agent Skills Directory

[COMMAND_EXECUTION]: The skill includes three Python scripts designed for execution by the agent: dependency_auditor.py, vulnerability_scanner.py, and pentest_report_generator.py. These scripts perform standard local file system operations, such as traversing directories, reading package manifest files (package.json, requirements.txt), and writing audit results to Markdown or JSON reports. The implementation uses standard library modules and does not perform any dangerous shell interpolation or unauthorized command execution.
[EXTERNAL_DOWNLOADS]: The documentation references standard security tools and ecosystem-specific audit commands, including npm audit, trufflehog, and nmap. These references target official repositories, well-known organizations (such as OWASP and Truffle Security), and established package registries. The use of these external resources is consistent with the primary purpose of a security auditing skill and involves no risky or untrusted sources.
[PROMPT_INJECTION]: The static analysis workflow represents a surface for indirect prompt injection by ingesting untrusted source code and interpolating extracted snippets into security reports. 1. Ingestion points: vulnerability_scanner.py reads source code files; 2. Boundary markers: Snippets are delimited using triple backticks in the Markdown output; 3. Capability inventory: The skill is scoped to local file system analysis and report writing; 4. Sanitization: Content is delimited but not filtered for natural language instructions. This is handled safely within the context of the skill's intended auditing function.

security-pen-testing