The Agent Skills Directory

[COMMAND_EXECUTION]: The skill instructs the agent to execute standard package manager CLI tools for auditing and version checking, such as npm audit, pnpm audit, yarn audit, pip-audit, govulncheck, and cargo audit.
[EXTERNAL_DOWNLOADS]: The instructions direct the agent to install dependencies (e.g., using npm install) if a lockfile is missing, which triggers downloads from official package registries.
[INDIRECT_PROMPT_INJECTION]: The skill has an attack surface for indirect prompt injection because it parses untrusted data from local project files during the audit process.
Ingestion points: Local lockfiles (e.g., package-lock.json, yarn.lock, Cargo.lock, go.sum, poetry.lock) and source code files accessed via grep.
Boundary markers: Absent.
Capability inventory: File system read access and execution of package manager subprocesses.
Sanitization: Absent; the skill relies on the agent's default handling of command output.

deps-audit