The Agent Skills Directory

[SAFE]: The skill is primarily instructional, providing a structured workflow for identifying security flaws in codebase entry points, authentication flows, and configuration.
[COMMAND_EXECUTION]: The skill includes scripts/scan_redflags.sh, which executes grep commands to perform static analysis on a provided directory. This script is used for diagnostic purposes to find potential secrets, dangerous APIs, and misconfigurations without executing the scanned code.
[INDIRECT_PROMPT_INJECTION]: The skill is designed to ingest and process codebase content for security reviews. While this constitutes an attack surface for processing untrusted data, the skill's scope is limited to generating audit reports for the user, and it lacks capabilities such as network exfiltration or automated code modification that could be abused through malicious code injection.

secure-by-default