The Agent Skills Directory

[COMMAND_EXECUTION]: The skill executes established security scanning tools (such as npm audit, pip-audit, govulncheck, and Google's osv-scanner) along with project-specific build and test scripts. This activity is restricted to the skill's primary defensive purpose and includes verification steps to ensure repository health is maintained.
[INDIRECT_PROMPT_INJECTION]: The skill possesses a surface for indirect injection as it ingests and processes source code and lockfiles from the repository.
Ingestion points: Reads all repository files, including third-party dependency data and source code.
Boundary markers: The skill uses a designated emoji (🔒) and clear instruction headers to separate its output. Most importantly, it implements a mandatory human-in-the-loop 'GATE' where the agent must present findings before taking any action.
Capability inventory: The skill has the capability to write to the filesystem (to fix vulnerabilities) and execute shell commands (to run scanners and verify builds).
Sanitization: Risks are mitigated by the 'GATE' triage process, which requires explicit user approval for remediation waves, and instructions that strictly prohibit printing discovered secret values to the output.

absolute-audit