The Agent Skills Directory

[SAFE]: The skill contains instructional content, vulnerability patterns, and report templates intended for security research and responsible disclosure. No malicious logic, data exfiltration, or obfuscation was found.
[COMMAND_EXECUTION]: The documentation includes an example of using the semgrep tool for static analysis. This is a legitimate security tool usage within the context of the skill's purpose and does not represent a security risk.
[PROMPT_INJECTION]: As the skill is designed to analyze external codebases, it inherently processes untrusted data which could lead to indirect prompt injection.
Ingestion points: Analyzes repository content and file paths as part of the security audit workflow.
Boundary markers: The instructions do not define specific delimiters for untrusted code segments.
Capability inventory: The skill suggests using shell commands for triage (e.g., semgrep).
Sanitization: No specific sanitization or validation of the analyzed code is mentioned, which is common for auditing tools. The risk is minimized as the skill defines a specific role for discovery, and the underlying LLM's safety guardrails apply during the analysis process.

security-bounty-hunter