The Agent Skills Directory

[COMMAND_EXECUTION]: The skill includes Python scripts (security_scanner.py, vulnerability_assessor.py, compliance_checker.py) that are intended to be executed via the command line. These scripts perform read-only file system operations by walking through a user-specified target directory to identify patterns related to security vulnerabilities (secrets, SQL injection, XSS) and compliance controls (authentication, encryption). All file access is scoped to the target path provided during invocation.
[INDIRECT_PROMPT_INJECTION]: The tool possesses an ingestion surface as it reads and processes the contents of arbitrary files within a target directory. However, the logic is restricted to static analysis (regex matching) and the generation of structured reports (JSON or text). The content of the scanned files is not used to dynamically influence the AI agent's internal control flow or system instructions, minimizing the risk of indirect injection attacks.
[DATA_EXPOSURE]: The skill is designed to detect and report sensitive data such as hardcoded secrets (API keys, AWS credentials) during its scanning phase. Findings are output to local files or the console as requested by the user. There is no evidence of unauthorized data exfiltration or transmission of identified sensitive information to external servers.
[REMOTE_CODE_EXECUTION]: While the skill's documentation provides examples of how to respond to CVEs and implement security controls, the included scripts do not perform remote downloads, package installations (e.g., pip install), or execution of untrusted code from the internet. The vulnerability assessment logic uses a hardcoded, internal database of known CVEs rather than making live network requests to external vulnerability databases.

senior-secops