The Agent Skills Directory

[COMMAND_EXECUTION]: The scripts/agent.py script executes the gitleaks and trufflehog CLI tools using subprocess.run with list-based arguments. The implementation correctly avoids using shell=True, which prevents command injection vulnerabilities from the user-supplied path argument.
[EXTERNAL_DOWNLOADS]: The SKILL.md and references/api-reference.md files provide instructions and links for installing third-party security tools. These references target well-known open-source repositories and package managers such as the official Gitleaks and Truffle Security GitHub repositories.
[INDIRECT_PROMPT_INJECTION]: The skill processes data from external security scanners which could contain content from untrusted source repositories. Ingestion points: The scripts/agent.py script reads output from gitleaks and trufflehog via temporary JSON files or captured stdout. Boundary markers: No explicit instruction delimiters are used for the scanner output. Capability inventory: The script performs file system reads/writes and executes CLI tools via subprocess.run in scripts/agent.py. Sanitization: The script parses tool outputs as JSON and redacts detected secrets before inclusion in the final report.

implementing-secrets-scanning-in-ci-cd