The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill ingests untrusted data by reading project files such as package.json, lockfiles, and CI configuration files. This presents a surface for indirect prompt injection where malicious instructions embedded in a repository's metadata or comments could attempt to influence the agent's audit findings. However, the skill includes explicit warnings about supply-chain risks and AI-hallucinated packages, and the risk is inherent to the auditing function.
Evidence Chain:
Ingestion points: package.json, package-lock.json, yarn.lock, pnpm-lock.yaml, .npmrc, .github/workflows/*.yml (via Read and Glob tools).
Boundary markers: None explicitly defined for file ingestion.
Capability inventory: Bash (limited to audit and inspection commands), Glob, Grep, Read.
Sanitization: No explicit sanitization of file content before analysis.
[COMMAND_EXECUTION]: The skill uses the Bash tool to run standard JavaScript package manager utilities. The recommended permissions are limited to read-only or diagnostic commands such as audit, outdated, explain, list, and view, as well as specialized linting tools like lockfile-lint and npq.
[PRIVILEGE_ESCALATION]: The incident-playbook.md file contains a reference to using sudo for manual domain blocking (editing /etc/hosts). This is provided as an instructional guide for human operators during a security incident response and is not executed automatically by the agent, thus it does not constitute an escalation of the agent's own privileges.

js-security-audit