The Agent Skills Directory

[COMMAND_EXECUTION]: The skill provides standard command-line instructions for installing and running security tools (e.g., pip install semgrep, docker run sonarqube, gh extension install github/gh-codeql). These are routine developer operations.
[EXTERNAL_DOWNLOADS]: The skill references official repositories and GitHub Actions from established providers (e.g., returntocorp/semgrep-action, github/gh-codeql). These follow the [TRUST-SCOPE-RULE] as they originate from well-known security organizations.
[INDIRECT_PROMPT_INJECTION]: The skill describes an attack surface where it processes source code for security analysis. However, it includes boundary markers and safety instructions, such as warnings about scanning sensitive repositories with third-party services and preventing secret leaks in logs. No malicious exploitation patterns were detected.

sast-configuration