The Agent Skills Directory

[SAFE]: The skill is a defensive resource focused on identifying and remediating supply chain vulnerabilities. It does not contain any malicious instructions, obfuscation, or unauthorized data access patterns.
[EXTERNAL_DOWNLOADS]: The skill recommends the installation of industry-standard security tools such as pip-audit, safety, osv-scanner, Trivy, cyclonedx-py, and guarddog. These resources are fetched from official package registries (PyPI) and official GitHub repositories belonging to recognized organizations like Google and the Python Packaging Authority (PyPA).
[COMMAND_EXECUTION]: Provides legitimate shell commands for security scanning, dependency visualization, and lockfile management. These commands are necessary for the skill's stated purpose of auditing and hardening Python project dependencies.
[INDIRECT_PROMPT_INJECTION]:
Ingestion points: The skill guides the agent to process project files such as requirements.txt, pyproject.toml, and poetry.lock (SKILL.md).
Boundary markers: No explicit boundary markers or "ignore embedded instructions" warnings are suggested for the input data files, which is consistent with the intended defensive audit workflow.
Capability inventory: The agent is instructed to execute subprocess calls for various auditing and management tools across the provided documentation and reference files.
Sanitization: The skill relies on established security tools (pip-audit, safety, bandit) to validate and audit the content of user-provided dependency files, which serves as a sanitization mechanism.

software-supply-chain-failures