The Agent Skills Directory

[SAFE]: The skill consists entirely of markdown documentation and instructional content for performing security audits. It does not contain any executable scripts, binaries, or automated network operations.
[SAFE]: Heuristic detections for destructive system commands (e.g., rm -rf /) in references/injection-prevention.md are educational code examples marked with ❌ to illustrate common security anti-patterns and vulnerabilities (Command Injection). These are part of the primary intended purpose of the skill to teach secure coding practices.
[INDIRECT_PROMPT_INJECTION]: The skill is designed to ingest and analyze external code provided by the user, which presents a potential surface for indirect prompt injection.
Ingestion points: The agent is instructed to audit files at a user-provided path during the 'Discover' phase defined in SKILL.md.
Boundary markers: The assets/output-report-template.md includes a specific warning block for the end-user, though the skill does not explicitly instruct the agent to use delimiters when processing the target code.
Capability inventory: No capabilities for file system modification, network exfiltration, or subprocess execution were identified in the skill's own instructions.
Sanitization: The skill instructions focus on generating text reports based on static analysis, posing minimal risk to the agent environment.

accelint-security-best-practices