The Agent Skills Directory

[SAFE]: The skill is focused on security auditing and privacy compliance. It includes built-in guardrails to prevent the exfiltration of sensitive data found during scans and specifically instructs the agent to handle PII types rather than raw values.
[EXTERNAL_DOWNLOADS]: The skill uses npx semgrep to perform automated PII scanning. Semgrep is a well-known technology service, and its use for security analysis is a standard practice that aligns with the skill's primary purpose.
[INDIRECT_PROMPT_INJECTION]: The skill ingests untrusted data by scanning the contents of the local src/ directory for PII and compliance violations.
Ingestion points: Source code files in the src/ directory are processed via semgrep and grep commands (SKILL.md).
Boundary markers: The instructions include meta-guidelines for the agent to focus on violation types and metadata rather than content, although explicit delimiters for the scanned code are not defined in the prompt templates.
Capability inventory: Analysis is performed using standard search and linting tools (grep, semgrep).
Sanitization: The skill scans raw source code to ensure effective detection of hardcoded PII, which is required for its auditing function.

privacy-audit