The Agent Skills Directory

[REMOTE_CODE_EXECUTION]: The documentation describes the insecure-external-code-execution configuration option. This parameter allows GitHub Dependabot to execute code found within manifest files (e.g., Ruby's Gemfile or Python's setup.py) during the dependency resolution process for specific ecosystems.
[EXTERNAL_DOWNLOADS]: The skill provides instructions for installing the advanced-security plugin from the official repository of the github organization to enhance dependency scanning capabilities.
[INDIRECT_PROMPT_INJECTION]: The skill facilitates an agent workflow that processes data from potentially untrusted external dependency manifest files during vulnerability scanning.
Ingestion points: Dependency manifest files such as package.json, requirements.txt, and pyproject.toml found within the repository (documented in SKILL.md).
Boundary markers: The instructions do not mention specific delimiters or boundary markers to isolate untrusted manifest data from agent commands.
Capability inventory: The workflow utilizes the dependabot toolset for advisory database lookups, pull request management, and GitHub MCP server interactions.
Sanitization: The skill does not describe specific sanitization or filtering steps for the content of manifest files before they are processed by the agent.

dependabot