The Agent Skills Directory

[EXTERNAL_DOWNLOADS]: The skill provides instructions to install security tools from official package registries using standard package managers such as pip, npm, gem, and brew. It also references official GitHub Actions from well-known providers like GitHub and SonarSource for CI/CD integration.
[COMMAND_EXECUTION]: The documentation includes standard command-line interface (CLI) examples for running static analysis tools (e.g., semgrep, bandit, brakeman). These commands are consistent with the tools' intended security auditing purpose.
[INDIRECT_PROMPT_INJECTION]: As a tool designed to process source code, the skill handles untrusted data. The author has implemented appropriate risk mitigations by including a 'Prerequisites' section that explicitly warns users to inspect tool effects, rules, and credentials before scanning untrusted code, and strongly recommends pinning action versions to avoid supply chain risks.

sast-scanning