The Agent Skills Directory

[EXTERNAL_DOWNLOADS]: The skill provides instructions for installing various industry-standard security tools from well-known package registries and official repositories.
Fetches security scanners such as Semgrep, Bandit, and Safety using pip.
Installs Node.js security plugins and Snyk using npm.
Downloads Go-specific security tools like GoSec and govulncheck from official Go package paths.
References official GitHub Actions for CI/CD security integration, including returntocorp/semgrep-action and aquasecurity/trivy-action.
[COMMAND_EXECUTION]: The skill provides numerous example commands for performing security reconnaissance, vulnerability scanning, and infrastructure auditing.
Includes commands for network discovery using nmap, dig, and subfinder.
Provides scanner invocations for gitleaks, trivy, checkov, and tfsec.
Contains instructions for interacting with cloud provider CLI tools (AWS, GCP, Azure) to verify security configurations.
Safety instructions explicitly mandate written authorization and adherence to rules of engagement before executing any active testing or exploitation commands.
[INDIRECT_PROMPT_INJECTION]: The skill is designed to ingest and analyze untrusted source code and infrastructure manifests for vulnerabilities, which constitutes a data ingestion surface.
Ingestion points: The skill uses Read, Glob, and Grep tools to process local project files and directory structures.
Capability inventory: The skill has access to Bash for running subprocesses and automated tools.
Sanitization: The instructions recommend the use of dedicated SAST tools and manual reviews to identify injection patterns, and emphasize the use of parameterized queries and sanitization libraries (e.g., DOMPurify) as remediation steps.
[DATA_EXFILTRATION]: While the reference files contain examples of sensitive data (e.g., AWS access keys, JWT tokens, and private key headers), these are used exclusively as signatures for secret scanning detection and educational vulnerability patterns. The instructions focus on identifying and remediating hardcoded secrets rather than exfiltrating them.

security-reviewer