The Agent Skills Directory

[PROMPT_INJECTION]: The skill includes explicit defensive instructions to prevent the agent from following malicious commands embedded in analyzed manifest files or lockfiles. It specifically directs the agent to treat strings such as "ignore previous instructions" as data to be triaged rather than as executable commands.\n- [EXTERNAL_DOWNLOADS]: The skill references several well-known security tools and official documentation from trusted organizations such as CycloneDX, SPDX, CISA, and NIST. These references are provided for information and triage guidance, and the skill does not contain any code to automatically download or execute external software.\n- [COMMAND_EXECUTION]: The skill documents numerous security auditing commands (e.g., npm audit, dotnet list package --vulnerable). While these are shell commands, the skill's metadata restricts its access to read-only file operations (Read, Grep, Glob), ensuring it cannot execute these commands in the user's environment.

dependency-scanning