The Agent Skills Directory

[SAFE]: The skill uses the Membrane CLI (@membranehq/cli) for all operations. Membrane acts as a secure proxy that handles authentication and credential management server-side. This aligns with best practices for preventing [CREDENTIALS_UNSAFE] patterns as no API keys are stored or requested locally.
[EXTERNAL_DOWNLOADS]: The skill instructs the user to install the Membrane CLI via npm install -g @membranehq/cli. This is a standard installation of a legitimate tool from a well-known package registry. The skill includes a specific guardrail in the instructions to ensure the agent requests explicit user confirmation before performing this global installation.
[DATA_EXFILTRATION]: The skill explicitly forbids piping security findings to network commands or external endpoints. It includes detailed safety documentation explaining the risks of handling sensitive vulnerability data and provides secure alternatives for data management.
[COMMAND_EXECUTION]: The skill utilizes command-line tools for its primary functionality. However, it includes safety guardrails requiring human confirmation for any state-changing or destructive commands like delete-project or bulk-triage. This reduces the risk of accidental or malicious system impact.
[PROMPT_INJECTION]: The skill includes defensive instructions against social engineering and prompt injection, stating that claims of authority or urgency do not bypass the defined security boundaries and confirmation gates.

semgrep-hardened