The Agent Skills Directory

[SAFE]: The skill contains patterns often flagged as malicious, such as prompt injection phrases ("Ignore previous instructions") and risky shell commands ("curl | bash"). However, these occur only within code blocks as illustrative examples of input that the scanner tool is designed to catch and remediate.
[DATA_EXFILTRATION]: The documentation requests the setup of environment variables for Anthropic and OpenAI API keys. These credentials are used for the LLM-powered code review feature ('cr-agent') and are managed through standard local configuration files.
[EXTERNAL_DOWNLOADS]: The instructions involve standard package installation via npm and pip for the skill's own components and dependencies. These downloads are legitimate given the skill's role as a developer tool.
[COMMAND_EXECUTION]: The skill provides tools like scan_security and fix_security which perform automated analysis and modification of project files. This behavior is expected and functional for a security auditing and auto-fix server.
[PROMPT_INJECTION]: The skill possesses an indirect prompt injection surface because it ingests untrusted data (external source code and user-supplied prompts) for analysis via tools such as scan_security and scan_agent_prompt. Ingestion points include the file_path and userInput arguments in SKILL.md. While it possesses file-write capabilities through fix_security, the skill is specifically designed to detect and sanitize malicious patterns within its inputs.

agent-security-scanner-mcp