The Agent Skills Directory

[EXTERNAL_DOWNLOADS]: The helper script scripts/cve_lookup.py fetches vulnerability enrichment data from well-known authoritative security services, including NIST's National Vulnerability Database (NVD), MITRE (CVE.org), CISA's Known Exploited Vulnerabilities (KEV) catalog, FIRST's Exploit Prediction Scoring System (EPSS), and Google's Open Source Vulnerabilities (OSV) database. These network operations are legitimate requests to official security intelligence providers.
[INDIRECT_PROMPT_INJECTION]: The skill processes vulnerability descriptions and references from external sources, which constitutes a surface for indirect prompt injection if those third-party records contain malicious instructions.
Ingestion points: Data from multiple external security APIs is fetched by scripts/cve_lookup.py and provided to the agent for analysis and reporting.
Boundary markers: SKILL.md defines a clear "Output Format" and structured "Workflow" that helps the agent maintain context separation between retrieved data and its own analysis.
Capability inventory: The skill uses a local script to perform network requests to specific, pre-defined authoritative domains and does not execute remote code.
Sanitization: The instructions explicitly require the agent to prioritize multiple primary sources, normalize identifiers, and resolve source disagreements, which acts as a verification mechanism to mitigate the impact of potentially poisoned external data.

cve-research