The Agent Skills Directory

[COMMAND_EXECUTION]: The skill requires the use of shell commands via the Bash tool to execute various security scanners and reconnaissance tools. Examples include semgrep, bandit, gitleaks, trivy, nmap, and sqlmap. These commands are standard professional tools used within the context of a security audit and are explicitly scoped for vulnerability identification.
[EXTERNAL_DOWNLOADS]: Reference documentation suggests installing security dependencies from established package managers such as npm and pip. Tools mentioned include snyk, bandit, safety, checkov, and gosec. These downloads target official registries and well-known technology providers.
[PROMPT_INJECTION]: The skill is designed to analyze external data including source code, infrastructure configurations, and log files. This presents a surface for indirect prompt injection (Category 8) where malicious content within the analyzed files could attempt to influence the agent's summary or report.
Ingestion points: The agent reads source code and YAML manifests (SKILL.md).
Boundary markers: The skill includes constraints such as "Manual review of auth, input handling, and crypto. Tools miss context — manual review is mandatory."
Capability inventory: The skill uses Read, Grep, Glob, and Bash tools across its scripts.
Sanitization: No specific prompt sanitization logic is present; the skill relies on the specialist's manual verification instructions.

security-reviewer