The Agent Skills Directory

[SAFE]: No malicious patterns or security risks were identified. The skill defines a structured workflow for security auditing based on industry-standard frameworks like OWASP and STRIDE.
[COMMAND_EXECUTION]: The skill documentation references the use of standard, well-known auditing tools such as npm audit, pip audit, and bundler-audit. These are legitimate utilities for identifying known vulnerabilities in project dependencies and do not constitute a security risk in this context.
[DATA_EXPOSURE]: The instructions include prompts for scanning a codebase for hardcoded secrets, API keys, and credentials. This is a standard defensive security practice intended to help developers identify and remediate sensitive data exposure vulnerabilities.
[INDIRECT_PROMPT_INJECTION]: The skill processes untrusted codebase data. Ingestion points include codebase files and metadata provided by the user. Capability inventory includes dependency auditing commands. This is a standard workflow for security analysis and lacks malicious intent or exfiltration paths.

security-audit