The Agent Skills Directory

[COMMAND_EXECUTION]: The skill instructs the agent to gather repository information using standard development tools such as git status and inspecting manifest files (e.g., package.json, Cargo.toml). These are routine actions for a software development assistant.
[EXTERNAL_DOWNLOADS]: The skill recommends the use of industry-standard package managers and auditing tools such as npm, pip-audit, and cargo audit. These tools are well-known and their use is considered a security best practice for managing dependencies.
[DATA_EXFILTRATION]: There is no evidence of unauthorized data access or exfiltration. In fact, the skill explicitly promotes security best practices, such as using Gitleaks or TruffleHog to scan for secrets and ensuring environment variables are handled through dedicated configuration modules rather than being scattered throughout the codebase.
[PROMPT_INJECTION]: The instructions are technical and educational in nature, focusing on improving code quality and architectural boundaries. There are no attempts to override agent safety guidelines or manipulate system prompts.
[REMOTE_CODE_EXECUTION]: The skill mentions various testing and linting frameworks (e.g., ruff, pytest, eslint, cargo clippy). While these involve code execution, they are standard tools used within the user's local development environment to verify code integrity and do not involve fetching and executing arbitrary scripts from unknown remote sources.

vibe-code-hardening