The Agent Skills Directory

[SAFE]: The skill functions as an educational and operational resource for security engineering, following industry standards like STRIDE and OWASP.
[COMMAND_EXECUTION]: Provides secret_scanner.py and threat_modeler.py for local analysis. These scripts are deterministic, performing pattern matching and data lookup without utilizing dangerous functions like eval(), exec(), or unsanitized subprocess calls.
[EXTERNAL_DOWNLOADS]: No remote code downloads or external network operations were found in the skill content or scripts.
[DATA_EXFILTRATION]: There is no evidence of data exfiltration. The secret_scanner.py utility explicitly masks detected secrets in its output to prevent accidental data exposure.
[PROMPT_INJECTION]: The skill workflows involve processing external data (code and architecture diagrams), which presents a standard surface for indirect prompt injection. However, the provided scripts do not execute the content they analyze, and the instructions focus on structured analysis rather than uncontrolled data ingestion.
[CREDENTIALS_UNSAFE]: While the skill contains regex patterns for detecting secrets, it does not contain any hardcoded credentials or private keys; example values in documentation are clearly marked placeholders.

senior-security