The Agent Skills Directory

[SAFE]: The skill performs local file system operations to save security reports to a user-defined or environment-configured directory. This behavior is the core intended purpose of the exporter and involves no unauthorized data transmission.
[PROMPT_INJECTION]: The skill possesses an ingestion surface for indirect prompt injection because it processes findings data and interpolates it into report templates without generic sanitization of the content fields.
Ingestion points: scripts/results_exporter.py (via export_results function)
Boundary markers: None implemented for findings data
Capability inventory: File system write access (Path.write_text)
Sanitization: The script specifically redacts a whitelist of sensitive HTTP headers (authorization, cookie, x-api-key, etc.) but does not sanitize other fields like description or vulnerable_code.

secdevai-export