The Agent Skills Directory

[COMMAND_EXECUTION]: The skill orchestrates a complex 11-agent analysis pipeline that executes multiple external shell and Python scripts (e.g., 'tools/emit_ir.sh', 'tools/extract_compile_flags.py', 'tools/generate_poc.py'). These scripts are companion assets required for extracting build flags, emitting IR/assembly, and performing semantic audits.
[REMOTE_CODE_EXECUTION]: The workflow includes phases for generating, compiling, and executing Proof-of-Concept (PoC) programs (via agents '5-poc-generator' and '5b-poc-validator'). This dynamic execution is a core feature used to verify the exploitability of detected zeroization issues at various optimization levels.
[EXTERNAL_DOWNLOADS]: The skill requires the 'uvx' package runner to execute the Serena MCP (Model Context Protocol) component, which typically involves fetching and running packages from external registries to facilitate symbol resolution and cross-file analysis.
[PROMPT_INJECTION]: The skill exhibits an indirect prompt injection surface by processing untrusted data to drive its analysis and code generation. 1. Ingestion points: Target repository root, build databases ('compile_commands.json'), and dependency manifests ('Cargo.toml'). 2. Boundary markers: No explicit prompt-level boundary markers are defined in the instructions to isolate untrusted code analysis. 3. Capability inventory: The skill can execute subprocesses, write files, and run compiled binary code (PoCs). 4. Sanitization: No specific sanitization or escaping protocols for ingested source code are documented in the instruction set.

zeroize-audit