The Agent Skills Directory

[COMMAND_EXECUTION]: The skill makes extensive use of shell commands to perform system audits, including find, grep, pgrep, ps, and netstat. These are used to identify malicious files, suspicious processes, and network connections associated with crypto miners or webshells.
[PRIVILEGE_ESCALATION]: The skill probes for privilege configuration by auditing the /etc/sudoers file and system-wide crontabs. It specifically looks for NOPASSWD entries that could be abused for privilege escalation. While these are sensitive actions, they are consistent with the skill's stated purpose as a security auditor.
[DYNAMIC_EXECUTION]: In Phase 1, the skill executes an embedded Python script using python3 -c to parse the composer.lock file and identify vulnerable versions of packages like intervention/image.
[INDIRECT_PROMPT_INJECTION]: The skill has an attack surface for indirect prompt injection as it processes untrusted data from the project being audited.
- Ingestion points: Reads content from composer.lock, .env, .htaccess, and scans various project directories (e.g., storage/, public/uploads/).
- Boundary markers: None identified; the skill does not use specific delimiters or instructions to ignore potential commands embedded in the files it scans.
- Capability inventory: Performs shell execution (find, grep, ps), reads sensitive files, and writes hardening configuration to .htaccess and nginx-security.conf files.
- Sanitization: The skill includes a sanitization step for credential discovery in Phase 3d, using sed to mask the values of sensitive environment variables before they are reported to the user.

security-audit