The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill exhibits a vulnerability surface for indirect prompt injection as its core purpose involves processing and analyzing untrusted external codebases.
Ingestion points: The skill uses Read, Grep, and Glob tools to ingest arbitrary source code and configuration files during audits (SKILL.md).
Boundary markers: While the workflow includes manual review checkpoints, there are no explicit instructions to use delimiters or 'ignore embedded instructions' warnings when the agent processes external file content.
Capability inventory: The skill has access to Bash for executing security tools and powerful file system utilities (Read, Glob, Grep).
Sanitization: No specific mechanisms for sanitizing or escaping ingested code content are detailed before the agent analyzes the data.
[COMMAND_EXECUTION]: The skill instructions and reference documents provide commands for executing various industry-standard security tools and performing reconnaissance.
Tools referenced include semgrep, bandit, gitleaks, npm audit, trivy, checkov, tfsec, nmap, and sqlmap.
Reconnaissance commands include DNS enumeration (dig, nslookup), subdomain discovery, and system auditing patterns (find, sudo -l).
These capabilities are aligned with the skill's primary function as a security review tool.
[EXTERNAL_DOWNLOADS]: The reference files contain instructions to fetch data from well-known security services and official tool repositories.
Fetches certificate transparency data from Sectigo's crt.sh service (references/penetration-testing.md).
Includes CI/CD pipeline examples that utilize official security actions from trusted organizations such as returntocorp (Semgrep), gitleaks, and aquasecurity (Trivy).

security-reviewer