The Agent Skills Directory

[SAFE]: The skill provides educational and practical guidance for security auditing. All code snippets provided in the reference files are standard security testing payloads (e.g., SQL injection sleep patterns, XSS alert boxes) or remediation examples (e.g., parameterized queries) intended for security analysts.
[COMMAND_EXECUTION]: The skill uses allowed-tools: Bash and provides various CLI commands for security scanning (e.g., semgrep, bandit, gitleaks). These are standard industry tools for the skill's stated purpose of vulnerability identification.
[EXTERNAL_DOWNLOADS]: The skill references several external resources and GitHub Actions from trusted organizations like returntocorp/semgrep-action, gitleaks/gitleaks-action, and aquasecurity/trivy-action. These are well-known security vendors and follow the trust-scope-rule.
[DATA_EXPOSURE]: While the skill contains regex patterns for detecting secrets (e.g., AWS keys, JWTs), these are part of a 'Secret Scanning' reference guide for auditors and do not exfiltrate data from the local environment.
[REMOTE_CODE_EXECUTION]: The skill documents how to test for RCE in target systems but does not contain any code to execute remote scripts on the agent's host environment.

security-reviewer