The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill's primary function involves analyzing untrusted external data, such as application source code, cloud configurations, and API responses. This creates an inherent attack surface for indirect prompt injection (8a, 8c), where malicious instructions could be embedded within the audited content to influence the agent's behavior. However, this is a known risk associated with the primary purpose of a security auditing tool.
[EXTERNAL_DOWNLOADS]: The documentation references several well-known security tools (OWASP ZAP, Prowler, ScoutSuite, Trivy, Grype, Checkov). These are documented as external dependencies for the auditing process. Since these are well-known industry-standard tools, their mention is considered safe.
[SAFE]: No malicious patterns, obfuscation, or unauthorized data exfiltration techniques were detected. The skill follows best practices for documenting security workflows and boundaries.

security-audit