The Agent Skills Directory

[SAFE]: The skill provides a defensive auditing workflow with robust security controls.
[SAFE]: It mandates the use of isolated sandboxes for target-controlled code execution, disabling network access and restricting file system writes to a temporary scratch directory.
[SAFE]: The included JavaScript validation utilities (validate-findings.cjs and validate-coverage-ledger.cjs) use security-focused APIs to prevent path traversal, symlink attacks, and terminal injection during the processing of audit results.
[SAFE]: The workflow incorporates a "Write isolation" procedure that uses race-safe file operations to promote audit artifacts from sandboxed environments to the final report.
[SAFE]: All instructions and guidance files are oriented toward identifying and remediating vulnerabilities in third-party code, rather than introducing risks to the host environment.

security-audit