The Agent Skills Directory

[Input Validation]: The core logic in scripts/vex_gate.py uses anchored regular expressions to extract vulnerability identifiers from GitHub issue bodies. This approach effectively manages the risk of malicious content in the input by ensuring only well-formed identifiers (like CVE or GHSA) are processed.
[VEX Document Parsing]: The skill processes OpenVEX JSON documents using standard library parsers. It includes error handling for malformed or missing files, defaulting to a 'proceed' state to ensure security triage is not silently skipped due to file corruption.
[Dependency Management]: The skill utilizes well-known development and testing tools such as pytest, ruff, and atheris. These dependencies are standard in the Python ecosystem and are used for maintaining code quality and security through fuzz testing.
[Indirect Prompt Injection Surface]: The skill processes externally-authored content from GitHub issue bodies. While this represents a potential surface area for indirect injection, the implementation mitigates this by limiting processing to specific markdown table cells and validating data against a strict allowlist of vulnerability prefixes.
[Security Documentation]: The inclusion of a detailed SECURITY.md provides a transparent STRIDE threat model, documenting potential risks and their associated mitigations. This practice aligns with industry-standard security modeling for enterprise software.

vex