The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill processes external data from security tools and APIs, which represents a potential surface for indirect prompt injection where malicious data could influence agent behavior.
Ingestion points: The skill ingests data from GitHub API responses (gh api), npm audit reports, and grype scan results.
Boundary markers: No explicit delimiters or instructions are provided to the agent to distinguish between the audit data and its own operational instructions.
Capability inventory: The skill utilizes command execution for tools like gh, npm, dotnet, and grype to read repository data and interact with the filesystem.
Sanitization: The skill relies on the standard output of established security tools without implementing additional sanitization or validation logic.
[COMMAND_EXECUTION]: The skill utilizes standard command-line tools for security auditing and dependency management in accordance with its stated purpose.
Evidence: Includes instructions for using gh api to fetch Dependabot alerts, npm audit for Node.js security checks, dotnet list package for NuGet vulnerabilities, and grype for container and filesystem scanning.

reviewing-dependencies