The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill is designed to process external data, specifically source code repositories and git history, during its AUDIT mode (documented in SKILL.md and rules/04-detection-and-remediation.md). This creates an ingestion surface for potential indirect prompt injection from audited code. The skill addresses this by instructing the agent to redact findings, perform manual triage, and report findings to the user rather than executing them, which is appropriate for its intended security-auditing purpose.
[COMMAND_EXECUTION]: To achieve its primary objective, the skill directs the agent to use standard security and development utilities such as git log, grep, gitleaks, and trufflehog (referenced in rules/04-detection-and-remediation.md). These executions are limited to the auditing scope and follow standard security practices.
[EXTERNAL_DOWNLOADS]: The skill mentions external developer tools like gitleaks and git-filter-repo (rules/04-detection-and-remediation.md). These are well-established, reputable tools within the security community and are used here for legitimate repository maintenance and scanning tasks.

sota-secrets-management