The Agent Skills Directory

[COMMAND_EXECUTION]: The scripts/security_scan.py script invokes the npm audit command via subprocess.run to check for dependency vulnerabilities. This is a functional requirement for the skill's purpose and is implemented without shell invocation to minimize risk.
[INDIRECT_PROMPT_INJECTION]: The skill processes external files (code and configuration) during its scanning phase. This represents a potential surface where an attacker could place malicious instructions in a codebase to influence the agent's reporting.
Ingestion points: Source code and configuration files read by scripts/security_scan.py in the targeted project path.
Boundary markers: The script outputs structured JSON data to represent findings, though it does not provide explicit prompt delimiters for the agent's final interpretation.
Capability inventory: subprocess.run (invoking npm audit), file system read access across common code and config extensions.
Sanitization: Content is analyzed via regular expressions to identify patterns rather than being executed or interpreted as instructions by the scanning script itself.

vulnerability-scanner