The Agent Skills Directory

[COMMAND_EXECUTION]: The script scripts/security_scan.py uses subprocess.run to invoke external security tools, specifically npm audit and pip-audit. These calls are implemented safely using argument lists and shutil.which for path resolution, preventing shell injection vulnerabilities.
[INDIRECT_PROMPT_INJECTION]: The skill acts as an ingestion surface by reading and processing arbitrary files from a user-specified project directory.
Ingestion points: The walk_files and read_lines functions in scripts/security_scan.py read all text files under the target directory for analysis.
Boundary markers: None. However, the data is processed locally by a Python script rather than being directly interpolated into a language model prompt.
Capability inventory: The skill can perform file system reads and execute specific local audit commands via subprocess.run.
Sanitization: The skill performs static regex matching and entropy calculations on the ingested data. It does not execute the content of the files it scans.

code-safety-audit