The Agent Skills Directory

Untrusted Data Ingestion: The skill is designed to ingest and analyze external Git diffs, pull requests, and commit data provided by the user.
Ingestion points: Git repositories, diffs, and local patches are loaded into the agent context through integrated tools and user prompts as described in SKILL.md.
Boundary markers: The skill relies on a linear, multi-phase execution sequence to separate data collection from final reporting, providing a structured boundary for processing.
Capability inventory: The agent has the capability to execute local scripts (e.g., generate_rank_input.py), write scan artifacts to the file system, and interact with specialized security workspace APIs.
Sanitization: Security findings undergo multiple layers of review, including a mandatory $validation phase and an $attack-path-analysis phase, ensuring that processed data is verified before the final report is generated.
Local Script Execution: The skill invokes local Python scripts to manage internal data structures and finalize scan results.
Evidence: Execution of <python_command> <plugin_dir>/scripts/generate_rank_input.py and python <plugin_dir>/scripts/finalize_scan_contract.py within SKILL.md.
Context: These scripts are part of the core plugin package and are used to automate the transformation of Git diffs into structured worklists, which is a standard operation for this type of security tool.
Coordinated Sub-agent Workflow: The skill acts as an orchestrator for several specialized sub-agents, such as $finding-discovery and $vulnerability-writeup.
Context: By breaking the scanning process into distinct phases with their own checklists and workflows, the skill enforces a rigorous review process that helps ensure the integrity and relevance of the security analysis.

security-diff-scan