The Agent Skills Directory

[SAFE]: The skill facilitates the installation and execution of deepsec, a tool provided by Vercel Labs, which is a well-known and trusted organization. References to other services like Anthropic and OpenAI for AI processing also target well-known and established providers.
[SAFE]: Secret management instructions, such as using .env.local for API keys and tokens, follow industry-standard safe practices for local development environments.
[SAFE]: The skill includes comprehensive guidance for CI/CD integration, specifically highlighting a two-job pattern for GitHub Actions. This pattern is designed to prevent malicious code in pull requests from accessing repository secrets or gaining write permissions, demonstrating a focus on privilege escalation prevention.
[INDIRECT_PROMPT_INJECTION]: The skill possesses a data ingestion surface as it is designed to analyze untrusted source code from target repositories. Instructions include sending code snippets to LLMs for vulnerability detection.
Ingestion points: Target repository source files are read during the scan and process stages (documented in SKILL.md).
Boundary markers: The skill explicitly instructs users to name primitives and avoid line numbers or generic CWE rehashes in the INFO.md file to maintain a tight, project-specific context (documented in resources/setup.md).
Capability inventory: The skill executes shell commands using bunx, npx, pnpm, or yarn, writes configuration and data files to the local .deepsec/ directory, and performs network operations to reach configured AI gateways.
Sanitization: The underlying deepsec CLI manages the extraction and transmission of code snippets to the configured LLM backends.

oma-deepsec