The Agent Skills Directory

[SAFE]: The skill serves as a comprehensive instruction set for performing security audits, covering industry-standard domains such as OWASP Top 10 (2025) and supply-chain security.- [SAFE]: The diagnostic commands provided for secret scanning (using rg) and dependency auditing (using npm audit, pip-audit) are standard security practices and do not involve credential exfiltration.- [SAFE]: Host compromise auditing instructions (Domain D5) leverage common Linux and Windows administration tools (ss, ps, awk, find) to inspect system integrity without performing malicious actions.- [SAFE]: The skill explicitly incorporates safeguards against AI-specific risks, such as treating untrusted content as data to prevent prompt injection (Domain D10).- [SAFE]: Static analysis hits regarding obfuscation are false positives; the skill mentions obfuscation patterns (e.g., eval(atob)) only as indicators for the auditor to look for when reviewing third-party code.

security-review