The Agent Skills Directory

Internal Script Execution: The skill executes Python scripts located within its plugin directory (such as generate_rank_input.py and finalize_scan_contract.py) to handle repository scoping and scan finalization. This is a functional requirement for its auditing capabilities.
Indirect Prompt Injection Surface: As its primary purpose is code auditing, the skill ingests and processes untrusted repository files and source code. The instructions include explicit directives to treat this input as untrusted analysis data, which is a recommended practice to mitigate risks associated with embedded instructions in scanned content.
Dynamic Command Resolution: The skill resolves the Python interpreter dynamically based on host environment variables (e.g., $PYTHON). While providing flexibility, this pattern relies on the integrity of the host environment's configuration for secure execution.

security-scan