The Agent Skills Directory

[SAFE]: The skill performs security auditing functions and does not contain any malicious patterns or behavior.\n- [COMMAND_EXECUTION]: The script scripts/agent.py invokes pip-audit via subprocess.run using a fixed list of arguments. It does not use shell=True and does not accept arbitrary user parameters inside the command array, preventing command injection vulnerabilities.\n- [EXTERNAL_DOWNLOADS]: The script makes HTTP requests to the official PyPI API (https://pypi.org) to fetch package metadata for verification. This communication is restricted to a well-known, trusted package registry and does not pose an exfiltration risk.

performing-supply-chain-attack-simulation