The Agent Skills Directory

[SAFE]: The skill provides a highly structured and disciplined methodology for security auditing, covering ten distinct domains including OWASP Top 10 (2025), secrets management, and supply-chain security.
[OBFUSCATION]: Static analysis flagged a 'Base64 decode chained with code execution' pattern; however, this is a false positive. The strings 'eval(atob(...))' and 'String.fromCharCode' appear in the Domain D4 checklist as text examples of malicious patterns to watch for during a third-party code review. They are not part of any executable logic within the skill itself.
[COMMAND_EXECUTION]: The skill utilizes standard, well-known diagnostic tools such as ripgrep (rg), ss, ps, and package managers (npm, dotnet, pip-audit) to audit system state. These are used for diagnostic purposes, such as searching for hardcoded secrets or listing open network listeners, and follow security best practices.
[INDIRECT_PROMPT_INJECTION]: The skill demonstrates high awareness of indirect prompt injection risks. It specifically instructs the agent to treat all third-party repository content as untrusted data and not to follow instructions embedded in READMEs, comments, or other metadata files during a review.
[SAFE]: The skill implements robust safety gates, such as Phase 1 validation of findings using a separate adversarial process and mandatory sandboxing for the initial run of third-party code.

security-review