The Agent Skills Directory

[COMMAND_EXECUTION]: The skill uses node:child_process to execute the semgrep binary. Analysis of src/index.ts shows that spawn and spawnSync are used with argument arrays rather than shell strings, which is a secure practice that prevents command injection. The commands are limited to checking the version and performing scans (semgrep scan --config ...).
[SAFE]: The skill's primary purpose is a security utility. It does not hardcode credentials, perform unexpected network requests, or attempt to persist across sessions. The external dependencies listed in package.json are standard development tools (@types/node, tsdown, typescript).

sast-runner