The Agent Skills Directory

[COMMAND_EXECUTION]: The skill executes shell commands using grep to search for security vulnerabilities, raw API calls, and hardcoded credentials within the codebase. It also runs pnpm audit and pnpm audit fix to manage and remediate dependency vulnerabilities.
[EXTERNAL_DOWNLOADS]: The skill performs installations of third-party libraries such as dompurify and zod via pnpm to facilitate security improvements like XSS sanitization and input validation.
[INDIRECT_PROMPT_INJECTION]: The skill has an attack surface for indirect prompt injection as it reads and processes content from various application source files (e.g., .tsx, .ts, .js, package.json).
Ingestion points: The skill reads src/main.tsx, src/App.tsx, vite.config.ts, package.json, and scans all files in the src/ directory for specific patterns.
Boundary markers: No specific delimiters or warnings are used to instruct the agent to ignore potentially malicious instructions embedded within the source files being audited.
Capability inventory: The skill possesses Shell (for grep and package management), Write (for rewriting source files and updating configuration), and Read capabilities.
Sanitization: The skill does not implement sanitization for the content it reads from the codebase before processing it.

security