The Agent Skills Directory

[COMMAND_EXECUTION]: The skill utilizes the Bash tool to execute standard security and auditing commands, including trufflehog, npm audit, pnpm audit, yarn audit, pip-audit, safety check, cargo audit, and dotnet list package. These are used as intended for auditing the project environment.
[INDIRECT_PROMPT_INJECTION]: The skill possesses an attack surface for indirect prompt injection as it is designed to ingest and process untrusted codebase content.
Ingestion points: The skill reads project files and searches codebase content using the Read, Grep, and Glob tools as specified in the audit process in SKILL.md.
Boundary markers: Absent. There are no explicit instructions or delimiters provided to help the agent distinguish between the audit instructions and potentially malicious instructions embedded within the audited files.
Capability inventory: The skill has access to powerful capabilities including Bash (command execution), WebFetch (network requests), and WebSearch tools.
Sanitization: Absent. The content of the audited codebase is not sanitized or filtered before being processed by the agent.

codebase-audit