The Agent Skills Directory

[EXTERNAL_DOWNLOADS]: The skill provides instructions for downloading and installing security tools from well-known sources.
SKILL.md: Fetches the Nuclei scanner binary from ProjectDiscovery's official GitHub repository.
SKILL.md: Provides instructions for installing the Nuclei scanner via the Go package manager from GitHub.
references/scanner-comparison.md: Recommends downloading the Trivy scanner from Aqua Security's official repositories and official Docker images.
[INDIRECT_PROMPT_INJECTION]: The skill scripts ingest external data from the filesystem to perform security analysis, which is the intended primary purpose of the skill but presents a potential vulnerability surface.
Ingestion points: Target files in the scan directory, dependency manifests (requirements.txt, package.json), and Kubernetes YAML manifests (scripts/scan-repo.sh).
Boundary markers: No specific delimiters or "ignore instructions" warnings are used when processing scan targets.
Capability inventory: The skill executes several security CLI tools including trivy, gitleaks, tfsec, kubesec, pip-audit, and npm audit.
Sanitization: No sanitization is performed on the files before scanning, as the tools themselves are designed to parse the raw data.
[CREDENTIALS_UNSAFE]: The example Python code for the Nessus API client disables SSL certificate verification, which is a security best practice violation.
SKILL.md: The NessusScanner class uses verify=False in requests.get and requests.post calls, which could theoretically allow a man-in-the-middle attack to intercept API keys.

vulnerability-scanning