The Agent Skills Directory

[SAFE]: The skill is a defensive security tool designed to identify and fix vulnerabilities. It contains well-researched guides covering OWASP Top 10, PII exposure, and specific CVEs (e.g., CVE-2025-29927, CVE-2025-55182).
[COMMAND_EXECUTION]: The scripts scripts/scan.sh and scripts/scan.ts utilize shell commands such as npm audit, grep, rg, and git ls-files to perform local static analysis and dependency checks. This execution is confined to the local environment and is necessary for the skill's stated purpose of auditing codebases.
[DATA_EXFILTRATION]: There is no evidence of data exfiltration. The scanning scripts output findings to a local directory (reports/scan-output), and the instructions explicitly warn against including sensitive data in logs or external trackers through the safe-log.ts utility.
[EXTERNAL_DOWNLOADS]: The skill references authoritative sources for security research, including official documentation from Cloudflare, Vercel, Stripe, and the NIST National Vulnerability Database (NVD). These references are used for intelligence gathering and do not involve untrusted code execution.
[INDIRECT_PROMPT_INJECTION]: As an auditing tool, this skill processes untrusted user-supplied codebases. While this constitutes an attack surface, the skill implements strict operating rules and a structured phase-based workflow in guides/00-principles.md to minimize the risk of malicious code influencing the agent's behavior.

security-weapon