The Agent Skills Directory

[COMMAND_EXECUTION]: The provided Python implementation of a scanner uses the subprocess.run method to execute external tools like Bandit and Semgrep. This is the intended primary function of the skill and uses a list-based argument passing method to avoid shell injection.
[EXTERNAL_DOWNLOADS]: The skill instructions include commands to install security-focused packages from well-known repositories like PyPI and NPM. These downloads are required for the tool selection described in the guide.
[INDIRECT_PROMPT_INJECTION]: The skill scans user-provided code, which acts as an untrusted input vector. 1. Ingestion points: The MultiLanguageSASTScanner.detect_languages and run_semgrep_scan methods in references/detailed-guide.md read files matching language patterns (e.g., *.py, *.js) from the provided project_path. 2. Boundary markers: The skill lacks instructions for the agent to use delimiters or ignore instructions found within the code being analyzed. 3. Capability inventory: The scanner in references/detailed-guide.md uses subprocess.run to execute commands and performs file system operations to read code and write JSON reports. 4. Sanitization: There is no evidence of filtering or sanitizing the file contents before they are passed to the scanning tools.

security-scanning-security-sast