The Agent Skills Directory

[SAFE]: The skill utilizes standard, well-known security tools such as semgrep and ripgrep for source code analysis. All external links point to official documentation at semgrep.dev, which is a recognized service in the security industry. No suspicious network activity or sensitive data exfiltration patterns were detected.
[INDIRECT_PROMPT_INJECTION]: The skill is designed to ingest and process untrusted source code data for scanning purposes, which constitutes a vulnerability surface for indirect prompt injection.
Ingestion points: The agent reads local source code files via ripgrep (file discovery) and semgrep (content analysis) as defined in SKILL.md.
Boundary markers: Absent; the skill does not explicitly instruct the agent to use specific delimiters or ignore embedded instructions within the code being scanned.
Capability inventory: The skill uses local shell execution to run semgrep and rg for file system read access and analysis.
Sanitization: None; the skill does not define specific sanitization or filtering for the code content before it is processed by the agent during the triage phase, though it provides interpretation rules to guide the agent's analysis.

semgrep-appsec-scanner