The Agent Skills Directory

[SAFE]: Technical analysis of the skill content confirms it is a security audit framework intended to help AI agents perform systematic code reviews. The skill provides reference material for OWASP standards and language-specific security patterns.
[REMOTE_CODE_EXECUTION]: Static detectors flagged the presence of eval, exec, and shell command patterns in SKILL.md and languages/python.md. Detailed review shows these are explicitly listed as 'Quick Patterns Reference' or 'Always Flag' categories for the agent to use as detection criteria when auditing user-provided code, rather than being part of the skill's own execution logic.
[PERSISTENCE]: A reverse shell pattern (os.system('bash -i >& /dev/tcp/...')) was identified in references/supply-chain.md. This is contained within a section titled 'Malicious Package Indicators' and is documented as a 'RED FLAG' for the auditor to recognize in external packages. It does not pose a threat to the execution environment.
[OBFUSCATION]: The skill mentions Base64 and Hex encoding techniques in its documentation (references/deserialization.md and references/supply-chain.md) to instruct the agent on how to identify hidden payloads in audited code. The skill itself does not employ any obfuscation.
[CREDENTIALS_UNSAFE]: While several placeholder keys (e.g., sk-..., AKIA...) appear in the reference files, they are clearly labeled as examples for detection or configuration. No functional hardcoded credentials belonging to the author or the environment were discovered.
[DATA_EXFILTRATION]: The skill contains no network-active components. All URL references point to reputable security documentation (OWASP, CWE, and the author's own domain getsentry.com), which are consistent with the skill's primary purpose.

security-review