The Agent Skills Directory

[PROMPT_INJECTION]: The automated scanner flagged patterns such as 'ignore all previous instructions' in checks/SEC-015.md. This file defines a security check for detecting 'Tool-Poisoning' and provides these strings as examples of malicious payloads the agent should look for in audited servers, rather than as instructions for the agent to follow.
[EXTERNAL_DOWNLOADS]: References to book.hacktricks.xyz in checks/SEC-004.md were flagged as malicious. This domain is a well-known technical resource for security research (HackTricks), and the link is used as a legitimate reference for Server-Side Request Forgery (SSRF) prevention strategies.
[COMMAND_EXECUTION]: Several automation scripts (e.g., audit-portfolio.sh, tools/propose_release.py, and scripts/validate.sh) utilize subprocess.run() or direct shell execution. These commands are restricted to administrative tasks such as git operations (git clone, git log), linter execution (ruff), and package management (pip), which are necessary for the skill to perform systematic repository audits.
[INDIRECT_PROMPT_INJECTION]: As an auditing tool that processes external repositories, the skill is exposed to untrusted data. However, the framework implements robust mitigation strategies, including strict whitespace normalization before text comparison, multiple automated validation gates for server profiles, and a core methodology ('Evidenz schlägt Vermutung') that prioritizes code-level evidence over interpreted text.

mcp-audit