The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill functions as a security auditor, which necessitates processing potentially untrusted data such as application architecture descriptions, source code for SAST scanning, and threat model inputs.
Ingestion points: User-provided system overview, assets, and data flow diagrams are processed as described in stride-analysis-patterns.md and SKILL.md.
Boundary markers: None explicitly enforced in the prompt structure, though the XML output format defined in SKILL.md helps segregate the agent's responses from raw data.
Capability inventory: No active capabilities (file writes, network requests, or shell executions) are present in the skill's own code; it provides logic templates for the agent's reasoning process.
Sanitization: The instructions emphasize a 'never trust user input' behavioral trait, though programmatic sanitization is not implemented in the provided Python data modeling templates.
[EXTERNAL_DOWNLOADS]: The sast-configuration.md file provides instructions and examples for installing well-known security industry tools, including Semgrep and CodeQL, from their official sources for the purpose of automated vulnerability detection.

security-auditor