The Agent Skills Directory

[PROMPT_INJECTION]: The skill includes a dedicated 'Instruction vs. data' section that serves as a defensive measure. It explicitly directs the agent to treat all external inputs (such as alert descriptions and API responses) as untrusted data and to ignore any embedded instructions that attempt to override the agent's defined workflow. This effectively mitigates risks associated with indirect prompt injection.
[COMMAND_EXECUTION]: The skill uses standard development tools including git, gh (GitHub CLI), yarn, and npm to perform its intended tasks. These operations are scoped to local repository management, dependency auditing, and interactions with the official GitHub API. All modifications, such as commits or PR creation, require explicit user approval.
[EXTERNAL_DOWNLOADS]: The skill executes yarn install to update project dependencies based on detected vulnerabilities. This is a standard operation for Node.js package management and relies on the project's existing configuration.
[DATA_EXFILTRATION]: No unauthorized data exfiltration patterns were detected. Network operations are limited to authenticated interactions with GitHub services for repository maintenance and vulnerability management.

fix-security-vulnerability