The Agent Skills Directory

[SAFE]: The skill is a legitimate security utility developed by a recognized vendor (Jeremy Longshore). It performs static analysis of local source trees to identify insecure deserialization patterns (CWE-502).
[COMMAND_EXECUTION]: The execution is limited to a local Python script (scan_deserialization.py) that performs string matching against file contents. It does not execute the code it analyzes.
[EXTERNAL_DOWNLOADS]: No external network requests or downloads are initiated by the skill scripts.
[DATA_EXFILTRATION]: No mechanisms for data exfiltration or sensitive information disclosure were found. The tool's allowed-tools list is restricted to local filesystem operations.
[INDIRECT_PROMPT_INJECTION]: While the tool reads untrusted source code and presents snippets to the agent, this is a necessary function of its primary purpose as a code scanner. The risk is mitigated by the structured nature of the findings and is considered inherent to the skill's utility.

detecting-insecure-deserialization