The Agent Skills Directory

[SAFE]: The skill is a comprehensive set of instructions for performing security audits on software projects. It provides a structured approach to identifying attack surfaces such as public APIs, local servers, and CLI tools, and defines specific checks for vulnerabilities like DNS rebinding, CORS misconfigurations, and improper input handling.
[DATA_EXFILTRATION]: While the skill instructs the agent to read sensitive configuration and project files (e.g., CI workflows, Dockerfiles, and server code), this access is scoped to static, defensive auditing. The skill explicitly forbids exfiltrating data, developing exploits, or probing live systems without prior authorization.
[COMMAND_EXECUTION]: The instructions mention command execution utilities like spawn, exec, and execa. However, these are listed as signals to detect within the audited project's code rather than commands for the agent to execute. The skill focuses on reviewing security posture rather than triggering active execution.
[PROMPT_INJECTION]: The skill contains instructions for auditing untrusted project data, which is a potential surface for indirect prompt injection. However, it mitigates this risk by explicitly defining its scope as static and defensive, providing clear criteria for what constitutes a security finding, and advising the agent to trace input flows responsibly.

security-surface-audit