The Agent Skills Directory

[SAFE]: The skill consists of a standard instructional framework for vulnerability assessment. It focuses on analytical tasks such as reachability tracing and control flow analysis, using standard security methodologies (CVSS, OWASP).
[EXTERNAL_DOWNLOADS]: The skill includes reference links to legitimate security tools and documentation, including the FIRST.org CVSS calculator, the OWASP testing guide, and a public GitHub repository from Factory-AI for attribution. None of these involve automated execution or installation of untrusted code.
[INDIRECT_PROMPT_INJECTION]: The skill is designed to process external security reports which could theoretically contain malicious instructions.
Ingestion points: Reads vulnerability findings from .flux/security/security-findings.json and system context from .flux/threat-model.md (SKILL.md).
Boundary markers: None present; the skill relies on the agent's ability to interpret the data as findings rather than instructions.
Capability inventory: The skill instructions are limited to data analysis and the generation of a JSON report (.flux/security/validated-findings.json). It does not define tools for network operations or command execution.
Sanitization: The skill does not explicitly instruct the agent to sanitize or escape the content of the ingested JSON files.

flux-opencode-vuln-validate