The Agent Skills Directory

[COMMAND_EXECUTION]: The skill provides a set of standard command-line tools for the agent to execute during an audit, including npm audit, pip-audit, git grep, trufflehog, and container scanners like trivy and docker scan. These are industry-standard tools for security assessment and do not involve unauthorized privilege escalation or persistence.
[PROMPT_INJECTION]: The skill is designed to analyze and process untrusted code and configuration files provided by users, which presents a surface for indirect prompt injection.
Ingestion points: Source code, dependency lists, and infrastructure configuration files provided by the user for audit via the skill's primary function.
Boundary markers: The skill does not define specific delimiters or instructions to prevent the agent from following instructions potentially embedded within the audited content.
Capability inventory: The skill utilizes shell commands for security scanning (git grep, trufflehog, npm audit, etc.) across the SKILL.md file.
Sanitization: No explicit sanitization or filtering is performed on the audited content before processing.

security-audit