The Agent Skills Directory

[EXTERNAL_DOWNLOADS]: The skill references and fetches security standards and guidance from well-known and trusted organizations, including OWASP (GitHub/org), NIST, CISA, and Mozilla (MDN). These references are used solely for authoritative security documentation.
[COMMAND_EXECUTION]: Instructs the agent to execute a local Python script (scripts/audit_web_security_basics.py) to perform passive security audits on a target URL. The script performs non-invasive checks of HTTPS/TLS configuration, security headers (CSP, HSTS, etc.), cookies, and basic HTML signals like mixed content or password forms over HTTP. No evidence of arbitrary command execution or malicious network exfiltration was found in the script.
[PROMPT_INJECTION]: Contains a dedicated 'Safety Boundary' section that explicitly prohibits providing offensive payloads, exploit chains, or bypass instructions. It reinforces defensive behavior and requires explicit authorization for active tests.
[DATA_EXFILTRATION]: The included auditing script connects only to the target URL provided by the user to perform its analysis. It does not send gathered data to external servers or domains.
[INDIRECT_PROMPT_INJECTION]: The skill acknowledges the risks of processing untrusted data (Category 8) in its references/ai-agent-security.md file, providing specific controls for handling model inputs, tool outputs, and retrieved content as untrusted to mitigate prompt injection and excessive agency risks.

web-security-architect