The Agent Skills Directory

[SAFE]: The skill functions as a documentation and process framework and contains no malicious instructions, obfuscation, or unauthorized access patterns.
[SAFE]: Recommendations for external tools, such as govulncheck and go-licenses, reference official and trusted repositories belonging to well-known organizations and the Go project maintainers.
[INDIRECT_PROMPT_INJECTION]: The skill has a data ingestion surface where it processes project manifests (e.g., package.json, requirements.txt, go.mod). No specific boundary markers or sanitization routines are defined in the instructions; however, the skill's capability inventory is limited to generating report tables and providing instructional CLI commands for user-driven remediation, which mitigates the risk of autonomous instruction following.
[COMMAND_EXECUTION]: The skill includes shell command templates for package managers (npm, pip, go, maven) as part of its remediation plan; these are clearly marked as instructional examples for the user to implement and do not represent autonomous command execution by the agent.

dependency-audit