The Agent Skills Directory

[COMMAND_EXECUTION]: The skill instructs the agent to run common security auditing tools including bandit, pip-audit, npm audit, and eslint on the codebase. These are standard tools for identifying vulnerabilities.
[EXTERNAL_DOWNLOADS]: The skill references standard dependency auditing tools like snyk and mvn dependency-check which interact with well-known package registries and vulnerability databases to identify security flaws.
[PROMPT_INJECTION]: The skill's primary function is to process and analyze external source code, which represents an attack surface for indirect prompt injection where malicious instructions could be embedded in the code being audited.
Ingestion points: User-provided source code and configuration files in the src/ directory.
Boundary markers: The skill does not define specific delimiters to separate untrusted code from its own instructions.
Capability inventory: The skill utilizes shell execution for static analysis tools (bandit, eslint) and dependency audits (npm, pip-audit).
Sanitization: No specific sanitization or escaping of the processed code content is described.

security-review