The Agent Skills Directory

[COMMAND_EXECUTION]: The skill includes a Python script (scripts/audit_skill.py) for static analysis. While it contains regex patterns to detect dangerous shell commands (e.g., sudo, rm -rf, mkfs) in target code, the script itself only performs standard file system read operations and does not execute subprocesses or shell commands.
[DATA_EXFILTRATION]: The auditing tool reads file contents and metadata to identify potential secrets and URLs for manual review. It does not possess network capabilities. Output is directed to stdout or a user-defined local file path, governed by validate_output_path which prevents writing into the target directory or overwriting source files.
[REMOTE_CODE_EXECUTION]: The tool is designed to avoid executing untrusted code. It uses the zipfile and tarfile modules to inspect archive metadata without extraction. It mitigates resource exhaustion risks by enforcing limits on archive member counts, individual file sizes, and aggregate expansion ratios.
[PROMPT_INJECTION]: The skill contains instructions for the agent to detect prompt injection attempts in other skills. It does not contain instructions that attempt to bypass the agent's own safety filters or override system prompts.
[INDIRECT_PROMPT_INJECTION]:
Ingestion points: The skill is designed to process untrusted external files (skills, code, manifests) which are read by the auditing script (scripts/audit_skill.py) and analyzed by the agent.
Boundary markers: The instructions explicitly define a safe inspection boundary, requiring the agent to work on read-only snapshots and treat all target content as untrusted data.
Capability inventory: The skill's primary capabilities are limited to reading local files, calculating cryptographic hashes, and writing a report to a local path. It lacks network access and dynamic code execution (eval/exec) capabilities.
Sanitization: The script limits content scanning to the first 1MB of text files and samples only 8KB for file type identification, preventing the ingestion of excessively large or malformed untrusted data directly into the prompt context.

skill-supply-chain-audit