The Agent Skills Directory

[SAFE]: The skill's primary function is to act as a security auditor. It provides detailed instructions (phases) for the agent to inspect a repository's security posture. All identified commands (e.g., git status, pnpm audit, grep for secrets) are standard defensive tools and are used here for legitimate auditing purposes.
[SAFE]: The skill uses ! commands (Dynamic Context Injection) in the provided documentation/references, but they are clearly marked as example audit commands (e.g., git status, ls -la) for the user to understand the audit flow. No silent exfiltration or malicious injection patterns were detected in the SKILL.md or references/fases.md.
[SAFE]: The skill explicitly instructs the agent not to perform dangerous actions, such as git push, executing unknown scripts without inspection, or modifying files if the repository has uncommitted changes.
[SAFE]: External references (such as to google/osv-scanner-action or gitleaks/gitleaks-action) target well-known, trusted security tools and organizations.

repo-first-defense