The Agent Skills Directory

[SAFE]: The skill's instructions and referenced commands are consistent with best practices for vulnerability management and software lifecycle maintenance. No malicious patterns, obfuscation, or unauthorized data access were identified.
[EXTERNAL_DOWNLOADS]: The skill references several well-known technology and security services to fetch vulnerability data and version support information. These include OSV.dev, FIRST.org (EPSS), CISA.gov (KEV), and endoflife.date. These interactions are strictly for data retrieval relevant to the skill's primary function.
[INDIRECT_PROMPT_INJECTION]: The skill possesses a surface for indirect prompt injection as it is designed to ingest and display data from external security databases and APIs. This surface is considered low-risk due to the reputable nature of the sources used.
Ingestion points: Security data queries to OSV, FIRST EPSS, CISA KEV, and endoflife.date in references/ecosystems.md.
Boundary markers: None explicitly mentioned for the ingestion of API results.
Capability inventory: The skill provides instructions for executing various package management and scanning tools (e.g., mvn, npm, go, osv-scanner, grype) as detailed in references/ecosystems.md.
Sanitization: Not explicitly implemented for the processing of external API responses.

dependency-management