The Agent Skills Directory

[EXTERNAL_DOWNLOADS]: The scripts/agent.py script performs network requests to registry.npmjs.org and pypi.org. These operations are used to verify package integrity and metadata against official repositories, which are well-known and trusted services.\n- [INDIRECT_PROMPT_INJECTION]: The skill is designed to ingest and analyze potentially malicious third-party files, including package.json, setup.py, and Windows PE binaries. This creates a theoretical surface for indirect prompt injection if the output of these analysis tools is processed by an agent without proper boundaries. However, the skill performs passive analysis and does not execute the content of the analyzed files.\n
Ingestion points: scripts/agent.py reads package configuration files; SKILL.md includes a script that parses PE binary structures using the pefile library.\n
Boundary markers: Not explicitly defined in the provided scripts.\n
Capability inventory: File system read access, network access to official package registries, and cryptographic hashing.\n
Sanitization: Content is analyzed for patterns but not sanitized for downstream LLM consumption.

analyzing-supply-chain-malware-artifacts