The Agent Skills Directory

[DATA_EXFILTRATION]: The skill is designed to search for and read sensitive information, which constitutes data exposure as defined in security guidelines.
Evidence: Instructions explicitly direct the agent to scan for .env files, hardcoded connection strings, API keys, tokens, and private keys or certificates within the target repository.
[INDIRECT_PROMPT_INJECTION]: The skill processes untrusted data from the audited codebase, creating an attack surface for indirect prompt injection.
Ingestion points: The skill uses broad read permissions (shared_read: ["*"]) to ingest source code, contracts, and configuration files.
Boundary markers: No explicit delimiters or instructions are provided to help the agent distinguish its own instructions from the content of the files being audited.
Capability inventory: The agent can execute shell commands via the Bash tool and has file system Write access to specific directories.
Sanitization: There is no evidence of input validation or sanitization of the content read from the codebase before it is analyzed by the model.
[COMMAND_EXECUTION]: The skill utilizes the Bash tool to execute standard security auditing utilities.
Evidence: The process section commands the execution of npm audit, pip-audit, govulncheck, and a local repository script scripts/scan-skills.sh.

security-agent