The Agent Skills Directory

[COMMAND_EXECUTION]: The skill instructs the agent to execute standard dependency auditing tools such as npm audit, pip-audit, cargo audit, govulncheck, bundle audit, composer audit, and mix audit based on the presence of specific project lockfiles. These commands are legitimate, well-known security utilities used to identify known vulnerabilities in software packages.
[INDIRECT_PROMPT_INJECTION]: The skill is designed to ingest and process untrusted external data in the form of code diffs and pull requests. While this creates a vulnerability surface for indirect instructions, the skill provides specific methodology and confidence gates for the agent to filter out noise and focus solely on tracing concrete exploit paths from untrusted sources to dangerous sinks.

security-audit