The Agent Skills Directory

[COMMAND_EXECUTION]: The skill executes standard system utilities such as grep, find, and git log to identify sensitive information and configuration issues within the local project directory. These operations are limited to the local file system and used for discovery purposes.
[EXTERNAL_DOWNLOADS]: The skill references and uses well-known dependency audit tools including npm audit, pip-audit, cargo audit, and govulncheck. These are industry-standard tools from reputable sources used to verify the security of project dependencies.
[INDIRECT_PROMPT_INJECTION]: The skill scans untrusted project files (source code, markdown, and config) for malicious patterns. While this constitutes an attack surface for indirect prompt injection, the risk is inherent to the tool's core function as a security scanner, and the instructions establish a professional auditor role for the agent.
Ingestion points: Project files are read and processed by grep and find commands as defined in SKILL.md.
Boundary markers: None explicitly defined within the scanned content, though the audit context is clear.
Capability inventory: The skill uses search utilities and package audit tools to analyze file contents and metadata.
Sanitization: Findings are processed and summarized by the agent into a structured report.

security-audit