The Agent Skills Directory

[EXTERNAL_DOWNLOADS]: The skill provides instructions for downloading and installing various security tools from external sources.
Fetches the official uv installation script from astral.sh (Astral).
Downloads the phylum security CLI from phylum.io (Phylum).
Retrieves the doppler CLI installer from doppler.com (Doppler).
References various security tools from socket.dev and osv.dev.
[REMOTE_CODE_EXECUTION]: The documented installation procedures for several tools utilize remote script execution patterns common for CLI utilities.
curl -LsSf https://astral.sh/uv/install.sh | sh for macOS/Linux uv installation.
powershell -c "irm https://astral.sh/uv/install.ps1 | iex" for Windows uv installation.
curl -sSL https://sh.phylum.io/ | sh for Phylum installation.
curl -Ls https://cli.doppler.com/install.sh | sh for Doppler installation.
[COMMAND_EXECUTION]: The skill contains multiple examples of shell commands intended for environment setup, package management, and security auditing.
Utilizes pip and uv for package installation and lockfile management.
Demonstrates usage of 1Password (op) and Doppler for secure secret injection into the shell environment via eval and run commands.
Provides GitHub Actions YAML configurations for automated security scanning and trusted publishing.
[INDIRECT_PROMPT_INJECTION]: The skill describes workflows for processing untrusted external data, such as PyPI package content and vulnerability database responses.
Ingestion points: Tools recommended (e.g., pip-audit, uv-secure, socket, phylum) ingest data from PyPI, GitHub, and local lockfiles (SKILL.md).
Boundary markers: The skill is a set of instructions; no explicit programmatic boundary markers are defined for the tools' execution logic.
Capability inventory: The skill provides instructions involving network access (registry queries), file system operations (lockfile reading/writing), and tool execution (uv, pip, phylum).
Sanitization: The guidance focuses on utilizing mature, established tools designed to safely process package metadata and SBOM files.

pypi-security-best-practices