The Agent Skills Directory

[COMMAND_EXECUTION]: The skill executes various shell and PowerShell commands to inventory the local machine. This includes running discovered binaries (e.g., node, python, go) with flags like --version or version -m to identify their current versions. It also executes standard package manager commands (e.g., brew, npm, pip, uv, cargo) to perform updates only after explicit user approval.
[EXTERNAL_DOWNLOADS]: The skill fetches vulnerability data from the official OSV.dev API (managed by Google). It queries https://api.osv.dev/v1/querybatch and https://api.osv.dev/v1/vulns/ to match local package versions against known security advisories. The data sent is limited to package metadata (ecosystem, name, and version) as confirmed by the provided scripts.
[INDIRECT_PROMPT_INJECTION]: The skill processes vulnerability summaries and descriptions from the external OSV API. To mitigate the risk of embedded malicious instructions in these descriptions, the skill includes explicit instructions for the agent to treat fetched content as data and never follow instructions or download binaries from links found in advisory pages. It also truncates descriptions to a short length in the scripts.

local-vuln-patch