The Agent Skills Directory

[COMMAND_EXECUTION]: The script scripts/security_scan.py uses subprocess.run to execute the npm audit command. This is a legitimate function of the tool's intended purpose to check for dependency vulnerabilities. The execution is performed with static arguments (--json) and a validated working directory.
[DATA_EXPOSURE]: The skill includes scanning logic for hardcoded credentials and sensitive information. These checks are performed locally on the provided project path, and the script does not contain any network operations or exfiltration patterns to send this data externally.
[INDIRECT_PROMPT_INJECTION]: The skill processes external data (source code and configuration files) using regular expressions to identify vulnerabilities. While this represents a data ingestion surface, the script treats the content as raw text for pattern matching and does not execute or interpret the scanned content, mitigating injection risks.
[SUPPLY_CHAIN_SECURITY]: The skill explicitly includes documentation and automated checks for OWASP A03:2025 (Software and Data Integrity Failures), promoting secure practices like verifying lockfiles and auditing third-party dependencies.

vulnerability-scanner