The Agent Skills Directory

[COMMAND_EXECUTION]: The skill employs shell commands via the Bash tool to conduct security analysis:
Executes npm audit to identify vulnerabilities in Node.js dependencies.
Uses grep and git log to find hardcoded secrets, environment variables, and cryptographic keys within the current codebase and historical commits.
Performs filesystem checks using test to verify the presence of lockfiles and configuration files.
[EXTERNAL_DOWNLOADS]: Initiates vulnerability checks by running npm audit, which communicates with the official NPM registry to compare local dependencies against known security advisories.
[PROMPT_INJECTION]: The skill processes untrusted project files, creating an attack surface for indirect prompt injection:
Ingestion points: Reads source code, configuration files, and git commit history using Read, Glob, and Grep tools (Phases 2, 4, 5, and 7).
Boundary markers: Does not implement explicit delimiter-based boundary markers or instructions to ignore embedded directives within the analyzed code content.
Capability inventory: Possesses the ability to execute shell commands (Bash), write analysis reports (Write), and orchestrate parallelized sub-tasks via spawn_agents_on_csv.
Sanitization: No specific sanitization or filtering logic is mentioned for the content extracted from project files before it is processed by the agent's logic.

security-audit