The Agent Skills Directory

[COMMAND_EXECUTION]: The skill uses the bash tool to execute standard security scanners (Bandit, Semgrep, Safety, TruffleHog) and local file system utilities (grep, find, wc) to audit codebase quality and security.
[EXTERNAL_DOWNLOADS]: The skill references the use of curl and Python's requests library in its documentation and examples for verifying API security configurations and testing network endpoints.
[PROMPT_INJECTION]: As an audit tool that ingests and processes external source code, the skill is subject to indirect prompt injection risks where malicious comments or data in audited files could attempt to influence the agent's findings. This is an inherent risk of its primary function.
[SAFE]: Hardcoded credential strings and Base64 sequences found in the skill are explicitly used as examples for detection patterns and anti-patterns in documentation rather than functional secrets.

audit-skill