The Agent Skills Directory

[SAFE]: The skill implements a framework for performing application security reviews and supply chain audits within the AI agent's environment.
[EXTERNAL_DOWNLOADS]: The pre-bash-package-guard.sh script fetches package metadata from the official NPM registry to verify the safety and age of packages being installed. These requests target a well-known service and are part of a defensive security posture.
[COMMAND_EXECUTION]: Local shell scripts utilize standard system utilities such as ripgrep, curl, and python3 to facilitate security scanning and JSON processing. The skill also leverages established security tools like osv-scanner for dependency analysis.
[DYNAMIC_EXECUTION]: Small Python 3 snippets are used within the shell hooks for data processing tasks, such as JSON encoding and calculating string similarity for typosquatting detection. These are restricted utility functions and do not execute untrusted code.
[SAFE]: Static analysis warnings regarding sensitive function names (like eval or exec) in documentation files are false positives; these are examples of vulnerabilities for a reviewer to identify in target codebases rather than code executed by the skill itself.

security-reviewer