The Agent Skills Directory

[SAFE]: The skill is a template for conducting security reviews. It provides clear categories (Authentication, Parameter Handling, etc.) and severity levels that align with standard security auditing practices.
[DATA_EXPOSURE_EXFILTRATION]: The skill includes a robust 'HARD-GATE' for credential handling (W007). It explicitly forbids the agent from reproducing discovered secrets, tokens, or API keys in its output, mandating the use of placeholders and file/line references instead. This proactive measure prevents sensitive data exposure.
[INDIRECT_PROMPT_INJECTION]: As a security auditing tool, the skill naturally ingests untrusted content from the workspace (source code). While this represents a potential attack surface for indirect prompt injection (e.g., malicious instructions hidden in code comments), the skill mitigates this by requiring the agent to verify each finding with a concrete attack scenario and generic placeholders, focusing the agent on objective code analysis rather than subjective instruction following.

security-check