The Agent Skills Directory

[EXTERNAL_DOWNLOADS]: The skill documents how to install the Opengrep tool and its rulesets from official sources, including GitHub (github.com/opengrep), PyPI, Homebrew, and the GitHub Container Registry (ghcr.io/opengrep). It also references a rules repository from Trail of Bits, a well-known security research firm. These are standard installation procedures for developer tooling.
[INDIRECT_PROMPT_INJECTION]: As a static analysis tool, Opengrep is designed to ingest and process external source code, configuration files (.opengrep.yml), and rulesets. This represents a potential surface for indirect prompt injection if an attacker embeds malicious instructions in code comments or strings that are then surfaced in the tool's output to the agent. However, this is an inherent characteristic of security scanning tools and is mitigated by the agent's typical output processing guardrails.
[COMMAND_EXECUTION]: The skill requires the Bash tool to execute Opengrep commands. The provided command examples are standard for static analysis workflows (e.g., opengrep scan ., opengrep scan --sarif) and do not involve suspicious or obfuscated execution patterns.

opengrep