The Agent Skills Directory

[SAFE]: The skill implements a robust security auditing workflow for codebase reviews, emphasizing sandboxed execution and write isolation.
[SAFE]: The included Node.js scripts (validate-findings.cjs and validate-coverage-ledger.cjs) employ defensive file-handling practices, such as O_NOFOLLOW and O_NONBLOCK flags, and enforce strict limits on file sizes and processing complexity to prevent resource exhaustion.
[SAFE]: The framework includes a well-defined "Artifact promotion procedure" in SKILL.md to ensure safe data movement between trust boundaries.
[SAFE]: The audit methodology explicitly forbids network access, live endpoint probing, and the use of production credentials, favoring local dummy data.
[SAFE]: No evidence of prompt injection, exfiltration, or obfuscation was identified.

security-audit