The Agent Skills Directory

[CREDENTIALS_UNSAFE]: The skill's evaluation directory contains files with hardcoded credentials and a private key block used as test fixtures (evals/cases/bad-appsec-committed-secrets/.env and deploy.key). These are explicitly marked as fake fixture data and are necessary for testing the skill's detection of the SEC-SEC-003 and SEC-SEC-004 rules.
[COMMAND_EXECUTION]: The skill is configured to execute standard ecosystem audit tools (such as npm audit, pip-audit, govulncheck, cargo audit, and bundle audit) using the Bash tool to perform dependency vulnerability scans.
[INDIRECT_PROMPT_INJECTION]: The skill has a surface for indirect prompt injection as it reads untrusted repository files (manifests, server configs). It mitigates this via explicit instructions.
Ingestion points: Files read using Glob and Read tools based on ecosystem detection (e.g., package.json, server.js).
Boundary markers: Explicitly defined in SKILL.md under the 'Reviewing untrusted input' section, instructing the agent to treat reviewed files as data and ignore any embedded directives.
Capability inventory: Uses Bash to run subprocess calls for official security audit tools.
Sanitization: Instructions mandate parsing structured tool output (JSON) and quoting exact configuration lines rather than interpreting free-form text.
[PROMPT_INJECTION]: The SKILL.md file contains keywords related to prompt injection (e.g., 'ignore previous instructions') within a defensive context, specifically instructing the agent to disregard such patterns if found in the user files being audited.

appsec