The Agent Skills Directory

[EXTERNAL_DOWNLOADS]: The skill fetches security tools and vulnerability data from well-known and official sources.
Instructions in references/policy-as-code.md and references/ci-cd-patterns.md include steps to download binaries for opa, trivy, and gitleaks from their respective official domains and GitHub repositories.
Python scripts examples/prioritization/epss-integration.py and examples/prioritization/kev-checker.py fetch live threat intelligence data from api.first.org and cisa.gov.
[INDIRECT_PROMPT_INJECTION]: The skill processes vulnerability scan results, which serves as an ingestion point for untrusted data.
Ingestion points: JSON scan results are ingested by epss-integration.py and kev-checker.py (referenced in SKILL.md).
Boundary markers: The scripts rely on structured JSON parsing to process specific fields like VulnerabilityID, but do not implement natural language delimiters to separate input from instructions.
Capability inventory: The processing scripts have network access (via requests) and file system access.
Sanitization: The scripts perform type validation (e.g., float casting for EPSS scores) and use standard JSON parsing libraries, which effectively mitigates common injection risks within data fields.

managing-vulnerabilities