The Agent Skills Directory

[PROMPT_INJECTION]: The skill exhibits an indirect prompt injection attack surface. It is designed to ingest and analyze untrusted external data, such as source code and infrastructure manifests, and then execute tasks based on that analysis. Ingestion points: The core workflow in SKILL.md and reference files involve reading the local filesystem and processing code using tools such as Read, Grep, and Bash. Boundary markers: The skill does not provide specific instructions or delimiters to the agent to distinguish between its own logic and potentially malicious instructions that might be embedded in the files being analyzed. Capability inventory: The skill utilizes Bash, Read, Glob, and Grep, which allow for file system access, network operations, and command execution. Sanitization: No explicit sanitization or input validation logic is provided for the agent to handle untrusted file content before it influences subsequent agent decisions.
[COMMAND_EXECUTION]: The skill provides numerous shell command templates for reconnaissance and active security testing. Evidence: references/penetration-testing.md contains commands for DNS enumeration (dig), port scanning (nmap), and vulnerability exploitation (sqlmap). While these are standard security practices, they involve active network interactions.
[EXTERNAL_DOWNLOADS]: The documentation guides the installation of various third-party security tools from public registries and repositories. Evidence: references/sast-tools.md and references/secret-scanning.md include commands to install software via pip (e.g., bandit, safety, trufflehog), npm (e.g., snyk, eslint-plugin-security), go install (e.g., gosec), and brew (e.g., trivy, gitleaks).
[CREDENTIALS_UNSAFE]: The skill references hardcoded credential patterns and placeholders in documentation. Evidence: references/infrastructure-security.md includes example configuration for HashiCorp Vault with hardcoded values like api_key="secret123" and password="vaultpass". These are clearly intended as illustrative examples rather than active secrets.

security-reviewer