The Agent Skills Directory

[SAFE]: The skill provides legitimate security auditing functionality based on the OWASP Top 10 framework, specifically focusing on Broken Access Control (A01:2021).
[SAFE]: It utilizes industry-standard security scanners (Semgrep, Bandit, Brakeman) to perform automated analysis, which is a common and safe practice for security tools.
[SAFE]: The detection patterns provided in references/detection-patterns.md are accurate educational resources that follow security best practices for identifying vulnerabilities such as Insecure Direct Object References (IDOR), CORS misconfigurations, and JWT verification issues.
[INDIRECT_PROMPT_INJECTION]: The skill analyzes external source code provided by the user, which presents an attack surface for indirect prompt injection if the code contains instructions designed to manipulate the auditing agent.
Ingestion points: Source code files located in routes, controllers, and middleware directories identified during the scope determination step in SKILL.md.
Boundary markers: None explicitly defined in the instructions to separate analyzed code content from the agent's internal instructions.
Capability inventory: Execution of security scanners (semgrep, bandit, brakeman) and shell commands (grep), along with read access to the local file system.
Sanitization: Results are normalized and formatted into structured reports, but the skill does not explicitly describe sanitization of the code snippets extracted for findings.

access-control