The Agent Skills Directory

[COMMAND_EXECUTION]: The skill methodology involves standard file system operations using shell commands such as ls, mkdir, and touch for organizing audit artifacts within a local directory (~/security-audit-skill/). It also executes a bundled Node.js script, validate-findings.cjs, to perform structural validation of report files.
[DYNAMIC_EXECUTION]: To increase finding confidence, the skill provides instructions to extract suspect code into standalone harnesses and execute them locally. This dynamic verification allows the agent to reproduce crashes or verify payloads discovered during static analysis.
[INDIRECT_PROMPT_INJECTION]: As a tool designed for auditing, it inherently processes untrusted third-party codebases.
Ingestion points: Path of the target codebase provided by the user in the audit setup phase.
Boundary markers: The skill relies on a multi-agent validation and verification workflow (Phase 3 and Phase 6) rather than explicit delimiters to mitigate the influence of embedded instructions.
Capability inventory: Platform-level Task tool for subagent delegation, file system access for reading/writing analysis results, and execution of local validation and reproduction scripts.
Sanitization: The instructions emphasize adversarial verification where a separate agent explicitly attempts to disprove the findings (Phase 3), acting as a logical gate to prevent obedience to malicious code comments.

security-audit