The Agent Skills Directory

[COMMAND_EXECUTION]: The skill includes instructions to execute local shell commands for auditing purposes, such as npm audit, yarn audit, and pnpm audit to check for package vulnerabilities. These are standard security utilities and do not download or execute untrusted remote code.
[COMMAND_EXECUTION]: The skill provides a shell command using git log and grep to scan the project's entire history for accidentally committed secrets like API keys and passwords. This is a legitimate defensive practice for auditing codebases.
[SAFE]: The skill's primary focus is checking for security misconfigurations such as missing Row Level Security (RLS) policies, insecure input handling (SQLi/XSS), and improper secret management. It does not exhibit malicious patterns like data exfiltration or obfuscation.
[PROMPT_INJECTION]: While the skill ingests untrusted code from the user for review (indirect ingestion surface), it uses a structured workflow with explicit user approval steps (STOP / APPROVE) and predefined checklists, which significantly reduces the risk of the agent being subverted by instructions embedded in the analyzed code.

security-review