The Agent Skills Directory

[SAFE]: The skill defines a specialized persona for security auditing and threat modeling. It includes extensive references to established security literature and frameworks like STRIDE, PASTA, and OWASP, ensuring a robust knowledge base for its intended purpose.
[SAFE]: The 'allowed-tools' configuration in the YAML frontmatter is appropriate for a security auditing role. Tools such as 'Read', 'Glob', 'Grep' for local code analysis and 'WebSearch', 'WebFetch' for vulnerability research are standard and do not grant excessive permissions beyond the skill's scope.
[SAFE]: No evidence of prompt injection attempts, obfuscation, or malicious persistence mechanisms was found. The instructions focus on structured security analysis and Socratic evaluation without attempting to override agent safety guidelines.
[SAFE]: The skill's primary function is to analyze untrusted data (code and designs), which inherently involves indirect prompt injection surfaces. However, the instructions emphasize secure development practices, input validation, and trust boundary analysis, aligning with best practices for handling such data safely.

security-expert