The Agent Skills Directory

[COMMAND_EXECUTION]: The skill relies on executing external binaries to perform security audits and verify dependency remediation.
The scripts/scan_dependencies.py wrapper uses subprocess.run to invoke osv-scanner for cross-ecosystem scanning.
Workflow instructions guide the agent to execute native ecosystem tools such as npm audit, pip-audit, cargo audit, govulncheck, and dotnet list package.
These executions are strictly scoped to the primary purpose of manifest analysis and project build verification.
[EXTERNAL_DOWNLOADS]: The skill documentation suggests downloading required security binaries from trusted technology providers.
It provides instructions for obtaining osv-scanner from Google's official GitHub repository or via established package managers like Homebrew and Go.
These references target well-known services and are used exclusively to fulfill the skill's technical prerequisites.
[PROMPT_INJECTION]: The skill processes data from external dependency manifests and advisory records, which represents a surface for indirect prompt injection.
Ingestion points: Data is ingested from osv-scanner JSON results, including package names, advisory titles, and vulnerability summaries in scripts/scan_dependencies.py and SKILL.md triage steps.
Boundary markers: There are no explicit delimiters used when the agent interpolates these external strings into the final report generated via references/vuln-report-template.md.
Capability inventory: The skill possesses significant capabilities, including modifying project manifests, regenerating lockfiles, and executing subprocesses for build verification.
Sanitization: There is no evidence of specific sanitization or filtering for the natural language strings parsed from tool outputs.
[SAFE]: The skill demonstrates high technical maturity and adherence to safety protocols.
It includes a comprehensive severity-policy.md that governs how severity is normalized and how remediation actions are classified (SAFE vs. BREAKING).
It mandates a verification cycle (install, compile, and test) after any dependency bump to ensure project stability.
Existing project security configurations (e.g., osv-scanner.toml, audit-ci) are respected to prevent bypassing local engineering decisions.

vulnerability-manager