The Agent Skills Directory

[EXTERNAL_DOWNLOADS]: The skill recommends the installation of the @socketsecurity/cli tool via the npm registry. This is the official command-line utility for Socket.dev, a well-known service providing supply chain security analysis. The download is necessary for the skill's primary functionality and originates from a recognized security organization.
[REMOTE_CODE_EXECUTION]: The skill's documentation contains examples of malicious shell commands, such as piping remote scripts to bash (e.g., curl | bash). These patterns are strictly used as reference material to teach the agent what to identify as a security threat during an audit and are explicitly labeled as 'UNSAFE' in the documentation context.
[INDIRECT_PROMPT_INJECTION]: The skill possesses an ingestion surface for indirect prompt injection as it is designed to scan and interpret untrusted third-party dependency files.
Ingestion points: Dependency manifests including package.json, package-lock.json, yarn.lock, requirements.txt, Pipfile, and pyproject.toml (SKILL.md).
Boundary markers: The skill instructions mandate the use of a structured findings format (Markdown table) to isolate data extracted from external files.
Capability inventory: Capability to read local manifest files and execute the socket CLI for scanning.
Sanitization: No explicit sanitization or filtering of the manifest content is described before the agent processes it for analysis.

socket-sca