The Agent Skills Directory

[SAFE]: The skill serves as an educational and procedural framework for conducting systematic security reviews of source code, design, and configuration using industry-standard taxonomies.- [INDIRECT_PROMPT_INJECTION]: The skill instructions involve analyzing untrusted external codebases provided by users, which constitutes an attack surface where instructions embedded in analyzed data could potentially influence the agent's logic.
Ingestion points: Source code, dependency files, and configuration files from the user's workspace are read and analyzed using Grep and Bash.
Boundary markers: No explicit delimiters or boundary instructions are defined to separate the untrusted codebase content from the agent's analytical prompts.
Capability inventory: The skill utilizes Read, Grep, and Bash tools to perform deep file system inspection and pattern matching.
Sanitization: There are no instructions for sanitizing or escaping the content of the analyzed files before including findings in a final report.- [EXTERNAL_DOWNLOADS]: The skill references numerous official security resources, including OWASP project pages, GitHub repositories for ASVS and Top 10 projects, and security research reports from well-known vendors like OpenAI, Anthropic, and Veracode. These references are used correctly for grounding and providing additional context for security auditors.

owasp-security