The Agent Skills Directory

[SAFE]: The skill is purely instructional, designed to guide an AI agent in performing security reviews. It contains no executable malicious code or dangerous instructions.
[CREDENTIALS_UNSAFE]: While the skill contains snippets of hardcoded API keys and passwords, these are explicitly labeled as negative examples ('FAIL') to demonstrate insecure practices that must be avoided. It correctly instructs the agent to use environment variables or dedicated secrets managers.
[COMMAND_EXECUTION]: Mentions standard development and auditing commands like npm audit, npm update, and npm ci within the context of maintaining secure dependencies and reproducible builds.
[EXTERNAL_DOWNLOADS]: References well-known security tools and official integrations from trusted organizations, such as TruffleHog for secret scanning and official AWS GitHub Actions for infrastructure management.

security-review