The Agent Skills Directory

[COMMAND_EXECUTION]: The skill provides several shell command templates in SKILL.md and references/ecosystems.md for performing audits on the host machine using docker run and docker exec. These templates use string interpolation for package names (e.g., <pkg>), versions, and ecosystem slugs.
[COMMAND_EXECUTION]: The use of shell-based interpolation in host-executed commands creates a command injection surface. A maliciously crafted package name containing shell metacharacters or quotes could potentially break out of the intended command string and execute arbitrary code on the host system.
[EXTERNAL_DOWNLOADS]: The skill's audit process involves interacting with multiple external security services and databases, including Google's deps.dev, OSV.dev, GitHub Advisory Database, Socket.dev, and Snyk. These are established and well-known platforms for security research.
[EXTERNAL_DOWNLOADS]: The skill provides instructions for downloading and installing various security auditing tools and CLI utilities, such as osv-scanner, the snyk CLI, and the socket CLI.

dependency-audit