The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill possesses a surface for indirect prompt injection as it ingests untrusted project data to perform security analysis.
Ingestion points: The skill reads local project files including README.md, package.json, requirements.txt, Dockerfiles, and source code directories.
Boundary markers: Instructions are prescriptive but do not implement specific delimiters for the parsed project data.
Capability inventory: The skill has extensive system access, including the ability to run shell commands (cdk deploy), manage Docker containers, and install packages.
Sanitization: The generate-html-report.py script uses DOMPurify to sanitize all markdown content before embedding it into the HTML report, effectively protecting the user from XSS attacks stemming from malicious project data.
[EXTERNAL_DOWNLOADS]: The skill facilitates the download and installation of various security tools from established sources.
Fetches the Automated Security Helper (ASH) from the official AWS Labs GitHub repository.
Downloads the uv tool from astral.sh for managed Python tool execution.
Incorporates standard security tools like trivy, viperlight, and license-checker from their respective official registries.
[COMMAND_EXECUTION]: The skill automates complex security workflows through shell command execution.
Performs infrastructure validation using npx cdk deploy.
Manages container security scanning via docker and trivy.
Coordinates report generation using integrated Python scripts.

security-scan