The Agent Skills Directory

[SAFE]: The skill provides two Python scripts, risk_calculator.py and vuln_prioritizer.py, which are benign tools for quantitative and qualitative analysis. They rely exclusively on standard library modules (e.g., csv, argparse, datetime) and do not perform network operations, use unsafe dynamic execution (like eval), or attempt privilege escalation.
[SAFE]: Extensive reference documentation (in the reference/ directory) covers topics such as application security, SOC operations, and compliance frameworks. These files contain educational code snippets that demonstrate how to implement security controls (e.g., Flask security headers, password hashing with bcrypt) and provide examples of vulnerable code for teaching purposes.
[SAFE]: The skill follows security best practices by recommending the use of environment variables or secrets managers for sensitive information, as seen in the placeholders and configuration examples provided in the documentation.
[SAFE]: The skill uses structured data formats (CSV) for input, and the provided scripts process this data using deterministic logic without treating string values as instructions, thus avoiding indirect injection risks.
[SAFE]: All external tools, frameworks, and GitHub Actions mentioned (e.g., NIST, CIS, Snyk, Gitleaks, Trivy) are well-known and standard industry resources.

security-compliance