The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill provides automated scripts that ingest and process data from external, untrusted sources like lockfiles and registry APIs without strict sanitization.
Ingestion points: Scripts in SKILL.md (specifically alert-new-deps.sh, blast-radius.sh, and the Python-based typosquatting detection) read and process contents from package-lock.json and git logs.
Boundary markers: Absent. There are no instructions or delimiters provided to ensure the agent ignores potentially malicious payloads embedded within package metadata.
Capability inventory: The skill utilizes curl, jq, grep, and bash to process and transmit data extracted from these sources, creating a surface where malicious package names could influence shell execution or webhook payloads.
Sanitization: Absent. The scripts perform direct extraction and interpolation of package names and versions without validation or escaping.
[COMMAND_EXECUTION]: The skill documentation provides numerous administrative and security commands for package auditing (npm audit, pip-audit, cargo audit), provenance verification (cosign, slsa-verifier), and incident response. These commands are intended for manual or CI/CD execution and are consistent with the skill's stated purpose of supply chain defense.
[EXTERNAL_DOWNLOADS]: The skill references several external security tools and libraries from well-known sources. These include Google's OSV scanner (osv-scanner), the Sigstore project (sigstore, cosign), the SLSA framework (slsa-verifier), and the Socket security CLI. These downloads target official package registries and trusted GitHub repositories.

supply-chain-attack-response