The Agent Skills Directory

[COMMAND_EXECUTION]: The skill utilizes local shell commands including find, grep, git, curl, pnpm build, and pnpm start to analyze the codebase and probe the application. These commands are executed within the local development environment and are standard for auditing activities.
[DATA_EXPOSURE]: The skill scans for potential secret leaks, such as environment variables improperly exposed to the client or secrets committed to version control. It maintains a strict "Hard rule" to exclude actual secret values from its evidence pack and reports, documenting only the variable names or locations to prevent accidental disclosure.
[INDIRECT_PROMPT_INJECTION]: The skill ingests untrusted data from the application under review, such as landing page text and documentation. This content is analyzed to detect contradictions between claims and implementation. While this creates a surface for indirect prompt injection, the risk is mitigated by the skill's structured auditing process, which requires specific evidence (file paths and line numbers) for all findings.
[SAFE]: The skill includes safety-conscious features such as requiring user consent before performing database-altering tests (like creating throwaway accounts) and ensuring proper cleanup afterwards. It is read-only by default and only applies fixes when explicitly requested by the user, adhering to the principle of least privilege.

review-an-app