The Agent Skills Directory

[SAFE]: The skill provides a structured framework for conducting security audits across multiple domains such as application security (OWASP Top 10 2025), secrets hygiene, and host integrity. It mandates systematic checks and evidence-based reporting, utilizing tools like ripgrep for secret detection and standard package managers for vulnerability scanning.
[OBFUSCATION]: Static analysis detected patterns associated with obfuscation in the documentation file references/security-audit-skill-vetting.md.
Evidence: The file contains a checklist item mentioning "Obfuscation red flags: eval(atob(...)), base64/hex string blobs, String.fromCharCode chains".
Context: These strings are part of instructional documentation designed to teach the agent how to identify malicious code in third-party repositories. They are not executable code segments and do not represent an attempt to hide the skill's own functionality.
[INDIRECT_PROMPT_INJECTION]: The skill's primary function involves processing untrusted data, such as project source code and third-party manifests, which creates a potential surface for indirect prompt injection.
Ingestion points: The skill reads source files, dependency lockfiles, and third-party documentation during the audit phase.
Boundary markers: The skill includes specific instructions in references/security-audit-skill-ai-agent.md to treat all external content as untrusted data and ensures agent instructions are never sourced from analyzed files.
Capability inventory: Capabilities are limited to file system reading, grep-based searching, and execution of standard security scanners.
Sanitization: The skill implements a mandatory human-in-the-loop validation gate for all findings before any remediation or fixing actions are taken.

security-audit