The Agent Skills Directory

[Input Data Validation]: The skill processes external GitHub issue bodies using the scripts/vex_gate.py script. It employs a strict, anchored regular expression (_VULN_ID_RE) to extract vulnerability identifiers. This validation ensures that only tokens matching specific, pre-defined formats (such as CVE or GHSA identifiers) are processed, effectively filtering out potentially malicious or irrelevant text injected into the source data.
[Deterministic Logic and Least Privilege]: The gate script is designed to be deterministic and runs with minimal permissions. It does not perform network requests, spawn subprocesses, or handle secrets. By restricting the script's capabilities to basic JSON parsing and text matching, the skill minimizes its runtime attack surface.
[Structured Security Modeling]: The inclusion of a detailed SECURITY.md file provides a transparent STRIDE threat model for the skill's executable components. This document identifies trust boundaries and potential risks—such as the consumption of AI credits—and outlines the specific in-code mitigations and workflow guardrails that address them.
[Standard Vulnerability Data Integration]: The skill references established and reputable vulnerability data sources, including OSV.dev, NIST's National Vulnerability Database (NVD), and the GitHub Advisory Database. These integrations follow standard industry practices for vulnerability enrichment and utilize well-known services for their intended purpose.

vex