The Agent Skills Directory

[SAFE]: The skill is a legitimate security auditing template that provides comprehensive guidance for performing code reviews based on industry-standard security frameworks like OWASP and CWE.
[CREDENTIALS_UNSAFE]: Reference files such as references/python.md and references/markdown.md contain example keys and passwords like 'sk-1234567890abcdef' and 'admin123'. These are explicitly marked as examples of unsafe practices within documentation and do not represent hardcoded credentials used by the skill itself.
[COMMAND_EXECUTION]: The skill integrates standard security analysis tools including bandit, cppcheck, shellcheck, and pip-audit. The instructions provide the correct, non-malicious invocation patterns for these industry-standard static analysis utilities.
[INDIRECT_PROMPT_INJECTION]: As a code review tool, the skill naturally ingests untrusted code for evaluation. The instructions mitigate injection risks by providing a rigid framework of checklists and a highly structured CSV output schema (security_code_review_report.csv), which constrains the agent's behavior to analysis tasks.
[SAFE]: The automated scanner detection of 'FileRepMalware' in SKILL.md and 'destructive system commands' in references/shell.md are confirmed false positives. These findings are triggered by descriptive text and educational examples of vulnerabilities (e.g., explaining why unquoted variables in rm -rf are dangerous) rather than executable malicious logic.

security-code-review