The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The script scripts/agent.py processes external OpenAPI specification files (YAML or JSON) provided by the user via the --spec command-line argument. While this is an ingestion point for untrusted data, the risk is minimized by the script's design.
Ingestion points: The --spec argument in scripts/agent.py allows the agent to read and parse external file content.
Boundary markers: The script generates structured JSON reports, though it does not use specific delimiters within the report to mark the untrusted source data.
Capability inventory: The script is limited to file system read/write operations (reading the spec and writing a report). It lacks network connectivity and shell execution capabilities.
Sanitization: The script uses yaml.safe_load() for YAML parsing, which is a secure method that prevents code execution during deserialization.
[EXTERNAL_DOWNLOADS]: The skill documentation references official 42Crunch tools, such as the @42crunch/cicd-cli npm package and 42Crunch GitHub Actions. These are resources from a well-known security service provider and are considered safe within the context of the skill's stated purpose. The skill also provides standard curl commands for interacting with the 42Crunch platform API.

implementing-api-security-testing-with-42crunch