The Agent Skills Directory

[COMMAND_EXECUTION]: The script scripts/inventory_dependency_files.py uses subprocess.run() to execute git commands for repository inventory. This is implemented safely using a wrapper (safe_git_command) that disables Git hooks (core.hooksPath=/dev/null), prevents interactive prompts, and disables network protocols to ensure a read-only, non-executable environment.
[SAFE]: The skill instructions (SKILL.md) and references enforce a strict safety boundary, explicitly forbidding the agent from running package lifecycle scripts, builds, or installing external tools during the audit. It includes specific warnings against running unsafe scanner modes like OSV-Scanner's Rust call analysis.
[SAFE]: Data handling is restricted to local discovery. The inventory script redacts locators (except for immutable Git commit SHAs) and instructions mandate that private coordinates, tokens, or registry URLs must never be exposed or transmitted during networked scans.

audit-dependencies