The Agent Skills Directory

[COMMAND_EXECUTION]: The skill uses node to run a local validation script (scripts/validate-finding.mjs) to verify security findings before reporting them. This script performs structural validation of JSON objects and checks for the existence of files and line numbers within the local repository environment.
[COMMAND_EXECUTION]: The skill instructions include grep patterns for the agent to use when searching for vulnerabilities like hardcoded secrets, XSS in templates ({@html}), and insecure authentication headers. These are standard search patterns executed within the restricted environment.
[DATA_EXPOSURE_AND_EXFILTRATION]: The skill explicitly instructs the agent to read local configuration files (.claude/tend/config.yaml) and sensitive files (via grep for tokens and keys) to identify security risks. However, the skill is configured with disable-model-invocation: true, and instructions strictly forbid network exfiltration or committing changes to the repository, requiring the agent to leave findings in the working tree for human review.

tend-security