The Agent Skills Directory

[Input Handling and Sanitization]: The skill is designed to ingest security findings from various third-party platforms. It includes explicit security instructions for the agent to treat all imported data as untrusted and to ignore any embedded commands or instructions within those findings, which effectively mitigates indirect prompt injection risks.
[Credential and API Security]: The workflow utilizes API tokens to interact with well-known services (GitHub, Atlassian, and Linear). The instructions contain clear guidelines to ensure these tokens are handled securely in memory and are never disclosed in the agent's output or logs.
[Static Evidence Analysis]: The skill performs read-only static analysis of the local repository to verify security claims. This involves tracing data flows and inspecting configuration files like SECURITY.md to establish the validity of a finding without performing dynamic execution or runtime validation.
[Resource Provenance]: External data is retrieved exclusively from well-known, official service endpoints using standard REST APIs. The skill prioritizes using built-in authentication mechanisms and provides fallback methods for token acquisition that align with standard developer practices.

triage-finding