The Agent Skills Directory

Dynamic Execution: The skill instructs the agent to validate security findings by compiling debug variants, running Proof-of-Concept (PoC) code, and utilizing debuggers such as gdb and lldb. These operations are fundamental to security validation but involve executing code that may be based on vulnerable patterns. To mitigate risk, the skill mandates non-interactive and bounded execution.
Command Execution: The workflow utilizes various command-line tools such as git and grep to explore code and reproduce vulnerabilities. While these are standard development and security tasks, the skill emphasizes keeping these commands short and scoped to avoid unintended side effects.
Indirect Prompt Injection: The skill processes external data which creates a potential surface for indirect prompt injection. Ingestion points: Data is ingested from external files such as false_positive_feedback.json and candidate security findings retrieved via specialized tools. Boundary markers: The skill includes an explicit instruction to treat external content strictly as data and not as instructions to prevent the data from influencing the agent's behavior. Capability inventory: The agent can invoke compilers, debuggers, and repository management tools across the project scope. Sanitization: The skill provides guidance on using non-interactive and bounded commands and utilizing disposable copies for build artifacts to protect the main environment.

validation