The Agent Skills Directory

[COMMAND_EXECUTION]: The skill orchestrates a wide array of legitimate security scanners and ecosystem-native tools (e.g., Syft, Grype, Trivy, OSV-Scanner, govulncheck, pip-audit, cargo-audit) via shell commands. These tools are used for their intended purpose of dependency auditing and SBOM generation.
[EXTERNAL_DOWNLOADS]: Fetches vulnerability metadata and exploitability scores from well-known and trusted security services, including Google's OSV database (api.osv.dev), CISA's Known Exploited Vulnerabilities (KEV) feed, and FIRST.org's Exploit Prediction Scoring System (EPSS) API.
[INDIRECT_PROMPT_INJECTION]: As a dependency auditing tool, the skill provides functionality to ingest and analyze external data from untrusted sources, such as third-party package manifests (lockfiles), registry metadata, and SBOMs. The skill mitigates this attack surface by providing structured workflows, reachability-aware triage, and detailed reasoning steps for the agent to follow when evaluating suspicious findings.
[DATA_EXFILTRATION]: No evidence of unauthorized data access or exfiltration. The skill explicitly monitors for exfiltration patterns in third-party packages, such as suspicious reads of credentials from ~/.aws or ~/.ssh during installation scripts.

sca-security