The Agent Skills Directory

Security Tool Integration: The skill utilizes opengrep and trivy for static analysis and dependency scanning. These are reputable open-source tools. The skill verifies their local installation before use, ensuring it does not download arbitrary executables at runtime.
Secret Protection Measures: A core constraint of the skill is the prevention of credential exposure. It explicitly instructs the agent to detect and mask any sensitive values (API keys, tokens, etc.) found in the source code before they are presented in reports or logs, replacing them with placeholders like ********.
Source Code Analysis Surface: The skill processes project files which are external and untrusted. While this is the intended purpose of a security scanner, it is noted as a standard surface for indirect prompt injection. The skill manages this risk by focusing on identifying patterns and providing structured analysis rather than executing the code contents.
Local Script Execution: The skill executes several bundled Node.js scripts to manage the scanning workflow and transform results. These scripts perform well-defined tasks such as tool detection and JSON normalization, and do not exhibit suspicious behaviors like network exfiltration or obfuscation.

scan-code