The Agent Skills Directory

[SAFE]: The skill implements robust XML parsing across all source adapters (JPCERT, MyJVN), providing protection against XML-based attacks.
Evidence: Uses defusedxml in scripts/jpsec/adapters/jpcert.py, scripts/jpsec/adapters/myjvn_alert.py, and scripts/jpsec/adapters/myjvn_vuln.py to mitigate XXE and DoS (billion laughs) vulnerabilities.
[EXTERNAL_DOWNLOADS]: The skill fetches data from established Japanese security organizations.
Evidence: Endpoints include https://www.jpcert.or.jp/rss/jpcert.rdf and https://jvndb.jvn.jp/myjvn. Requests are constrained to HTTPS and use a specific User-Agent.
[COMMAND_EXECUTION]: A shell execution pattern was detected in the test suite.
Evidence: subprocess.run is used in tests/test_cli.py to execute the local CLI script during automated tests. This is restricted to the skill's own entry point and is not part of the production runtime path.
[SAFE]: Caching functionality is storage-conscious and disabled by default.
Evidence: scripts/jpsec/http_cache.py only performs filesystem writes if a cache_dir is explicitly provided by the user. It uses SHA-256 for cache keys and supports standard ETag/Last-Modified headers.

jp-security-advisories