The Agent Skills Directory

[SAFE]: The skill facilitates security audits using legitimate, open-source, and well-known industry tools. Its operations are transparent and consistent with its stated purpose of catching vulnerabilities early in the development lifecycle.
[EXTERNAL_DOWNLOADS]: Recommends installing security utilities from official package registries (Homebrew, npm, PyPI, Go, and Cargo). These tools, such as trufflehog, trivy, and semgrep, are standard in the security industry.
[REMOTE_CODE_EXECUTION]: Provides configuration examples for GitHub Actions and GitLab CI using official actions and container images from trusted organizations like Aqua Security, Truffle Security, and Semgrep. These references are used for intended automated security scanning functionality.
[COMMAND_EXECUTION]: Uses bash to execute local auditing tools. The commands target project files to detect hardcoded secrets and known vulnerabilities, which is the primary and safe use case for this skill.
[DATA_EXFILTRATION]: While the skill identifies sensitive data like API keys and private keys via grep and dedicated scanners, it does so locally or within trusted CI environments. No unauthorized network transmission of sensitive data was detected.

loom-security-scan