The Agent Skills Directory

[COMMAND_EXECUTION]: The skill uses subprocess.run in scripts/agent.py and scripts/process.py to execute external security tools including semgrep, codeql, and gh. These operations are essential for the primary purpose of automating security scanning and reporting findings.
[INDIRECT_PROMPT_INJECTION]: The skill has an indirect prompt injection surface as it ingests and processes external SARIF and JSON reports generated by third-party tools. Ingestion points: scripts/process.py (SARIF files), scripts/agent.py (Semgrep JSON). Boundary markers: Absent. Capability inventory: subprocess.run for running semgrep, codeql, and gh. Sanitization: Absent; the skill uses values from JSON reports in its own outputs without additional validation.

integrating-sast-into-github-actions-pipeline