The Agent Skills Directory

[COMMAND_EXECUTION]: The script scripts/audit_python.py invokes the pip-audit and pip command-line tools using the subprocess module. This execution is used solely to perform dependency analysis and version checking as per the skill's primary purpose. The command construction uses list-based arguments rather than shell strings, which follows security best practices.
[EXTERNAL_DOWNLOADS]: The skill utilizes pip-audit, which connects to api.osv.dev and pypi.org to retrieve the latest vulnerability advisories and package metadata. These are established, well-known services for Python security data.
[INDIRECT_PROMPT_INJECTION]: The skill processes project-supplied configuration files to identify dependencies for auditing.
Ingestion points: scripts/audit_python.py reads local files including poetry.lock, Pipfile.lock, requirements*.txt, and pyproject.toml.
Boundary markers: While no explicit natural language delimiters are used, the script relies on structured file formats and the underlying auditor tool's formal parsers.
Capability inventory: The skill can execute specific shell commands (pip-audit, pip) and read project files, but lacks dangerous capabilities like network exfiltration or system modification.
Sanitization: Input file paths are resolved through standard libraries and tool outputs are parsed as structured JSON, providing inherent validation against malformed or malicious content.

auditing-python-dependencies