The Agent Skills Directory

Command Execution: The skill utilizes local shell commands to execute Python scripts, such as generate_in_scope_files.py, normalize_candidates.py, and finalize_scan_contract.py. These scripts are used to identify changed files and manage findings within the local repository environment.
Dynamic Execution: The workflow involves calling external scripts located within the plugin's directory. This is a mechanism used to perform technical analysis and data normalization that exceeds the standard text-processing capabilities of the agent.
Indirect Prompt Injection: Because the skill is designed to analyze external code changes (like pull requests and commits), it identifies these inputs as untrusted ingestion points. The instructions include security measures, such as treating user context as untrusted and prohibiting the agent from following or dereferencing URLs encountered within the analyzed code, to mitigate potential injection risks.

security-diff-scan