The Agent Skills Directory

[COMMAND_EXECUTION]: The skill provides several administrative scripts for project auditing. For instance, verify-reproducible-build.sh manages build process verification for Go, Docker, and Node.js environments. These scripts are designed for legitimate security auditing tasks and include safeguards against command injection by validating input arguments against allowlists.
[INDIRECT_PROMPT_INJECTION]: The skill possesses an attack surface for indirect injection as it ingests untrusted codebases and external security registry data.
Ingestion points: The skill uses Read, Glob, and Grep tools to analyze repository files (e.g., composer.json, package.json, .github/workflows/*.yml) and uses scripts that fetch data from external APIs like bestpractices.dev and sonarcloud.io via curl and urllib.
Boundary markers: Instructions rely on standard agent discovery workflows but do not specify unique delimiters for all processed data.
Capability inventory: The skill can execute shell scripts, write files to the repository, and make network requests using the gh CLI and curl tools.
Sanitization: Audit scripts include validation of input arguments (e.g., build type allowlists in verify-reproducible-build.sh and path validation) to prevent misuse during repository manipulation.
[EXTERNAL_DOWNLOADS]: The skill programmatically fetches security metadata and badge information from trusted services such as bestpractices.dev, sonarcloud.io, and securityscorecards.dev. These operations are documented neutrally and are consistent with the skill's primary function of security assessment and badge status verification.

enterprise-readiness