The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill processes untrusted data from external project files such as lockfiles (package-lock.json, pnpm-lock.yaml, etc.), Dockerfiles, SBOMs, and SCA reports. These files could be manipulated by an attacker to include malicious instructions intended to influence the AI agent's behavior during the analysis phase.
Ingestion points: Project repository files including package-lock.json, pnpm-lock.yaml, SBOM files, and Dockerfile (referenced in SKILL.md sections 2, 4, and 5).
Boundary markers: The skill does not explicitly define prompt delimiters or specific 'ignore embedded instructions' warnings for the external data it reads.
Capability inventory: The skill has access to Bash, Read, Grep, and Glob tools, which provide significant capabilities for file system access and command execution.
Sanitization: While the skill uses appsec-sdk redact to protect sensitive output, it lacks input-side sanitization or validation for the content of the project files it processes.
[COMMAND_EXECUTION]: The skill relies heavily on the execution of shell commands via the Bash tool to perform its primary functions, such as running security scanners like syft, trivy, osv-scanner, and prowler. While these are legitimate security tools, the use of a shell environment to process data from a repository introduces a risk of command injection if file names or contents are not handled securely.

security-platform-supply-chain