The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill is designed to process untrusted data (source code, agent skill packages, and MCP components) which could contain malicious instructions intended to manipulate the agent. The skill includes specific guardrails to mitigate this risk, such as forbidding the execution of instructions found in scanned targets and requiring non-discoverer verifiers for all findings.
Ingestion points: SKILL.md (target inputs), resources/mcp-scanning.md (MCP snapshots/remote endpoints), resources/skill-scanning.md (skill directory targets).
Boundary markers: Explicit guardrails in SKILL.md instruct the agent to ignore instructions found in scanned repositories; the skill uses structured output formats (run.json, findings.json) to maintain data integrity.
Capability inventory: The skill executes local binaries, makes network requests to LLM APIs for analysis, and performs web testing via the ARTEX platform.
Sanitization: Instructions require redacting sensitive data (cookies, keys, passwords) from sharing copies and using restricted sandboxes for local validation reproduction.
[EXTERNAL_DOWNLOADS]: The skill references several external security tools and repositories for its scanning operations, including Deepsec, Cisco's security toolset, and third-party forks of the ARTEX testing tool.
Evidence: Mentions of github.com/vercel-labs/deepsec, github.com/cisco-open/ai-deep-sast, github.com/cisco-ai-defense/mcp-scanner, and forks like Hinln/ARTEX.
Mitigation: The skill enforces strict version pinning (commit hashes and digests) and explicitly warns against using unverified forks or floating tags like latest.
[COMMAND_EXECUTION]: The skill orchestrates the execution of various security scanning CLI tools.
Evidence: Use of npx deepsec, python aideepsast.py, skill-scanner, and mcp-scanner.
Mitigation: Commands are executed within bounded resource limits, with budget controls, and any execution of code derived from a target is restricted to an OS-enforced sandbox with no external network access.

oma-security