The Agent Skills Directory

[SAFE]: The skill is intended for codebase security discovery and documentation. The instructions provide a structured template for a security reviewer to follow when assessing a new project.
[COMMAND_EXECUTION]: The skill utilizes standard unix utilities (find, grep) to locate files related to authentication, cryptography, and configuration. These commands are executed locally on the path provided via the $ARGUMENTS parameter.
[DATA_EXPOSURE]: The discovery commands specifically look for sensitive files such as .env, .pem keys, and configuration files. This is a legitimate activity for a security discovery tool intended to help a human auditor map the project's security posture. There is no evidence of these files being exfiltrated.
[EXTERNAL_DOWNLOADS]: The documentation mentions standard dependency auditing tools (npm audit, pip-audit, govulncheck, bundle audit). These are industry-standard tools for identifying known vulnerabilities in third-party packages.
[INDIRECT_PROMPT_INJECTION]: The skill processes external codebase content during analysis. This represents an attack surface where malicious code could attempt to influence the agent's summary; however, the structured template approach and the focus on documentation mitigate this risk. This is considered a low-risk surface inherent to the tool's purpose.

codebase-discovery