The Agent Skills Directory

[EXTERNAL_DOWNLOADS]: The skill provides instructions to install the OpenSSF Scorecard utility using go install sigs.k8s.io/scorecard/v4@latest. This source is a well-known Kubernetes-related infrastructure provider.
[COMMAND_EXECUTION]: Shell commands are used to inspect local project configuration files, such as crew.yml, package.json, and Gemfile. These operations are limited to reading files and filtering text using standard utilities like grep, awk, and jq.
[DYNAMIC_EXECUTION]: A Python one-liner is used to parse JSON content from package.json for dependency classification. This is a static script for data extraction and does not execute arbitrary code from external inputs.
[INDIRECT_PROMPT_INJECTION]: The skill ingests data from external security advisories and local dependency files to determine priority levels. While this represents a data ingestion surface, the risk is inherent to the primary purpose of security triage, and the instructions focus on manual or semi-automated classification rather than autonomous execution of untrusted commands.

security-check