The Agent Skills Directory

[SAFE]: The skill instructions and accompanying reference documents (e.g., references/security.md, references/data.md) align with security industry standards like OWASP. They provide explicit guidance on detecting and mitigating common vulnerabilities.
[CREDENTIALS_UNSAFE]: The evaluation file evals/files/LoginForm.tsx contains a hardcoded credential (sk_live_9f8a7b6c5d4e3f2a1b0c). This is documented in evals/evals.json as a seeded defect intended to test the agent's ability to identify secrets in code.
[DATA_EXPOSURE]: Several files in the evals/files/ directory (e.g., orders.js, documents_service.py) contain intentional security flaws, including SQL injection, cross-tenant data leaks, and insecure authentication handling. These serve exclusively as test cases for the code review workflow.
[COMMAND_EXECUTION]: The skill workflow (Phase 4) suggests using linters and security analyzers like Semgrep or CodeQL if available in the environment, but it does not contain code to execute these tools autonomously in an unsafe manner.

code-review