The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill is designed to ingest and process untrusted data from various dependency manifest and lockfiles.
Ingestion points: The skill scans files such as package.json, package-lock.json, requirements.txt, pyproject.toml, go.mod, and Cargo.toml across project directories.
Boundary markers: Instructions explicitly require the agent to avoid running auto-fix or upgrade steps without user approval and to treat dependency changes as release-impacting events.
Capability inventory: The provided code patterns include capabilities for file system exploration (globbing) and executing external tools via subprocess.run.
Sanitization: The skill emphasizes structural parsing of tool outputs (e.g., json.loads) and classifying exit codes to distinguish findings from tool errors.
[COMMAND_EXECUTION]: The implementation playbook includes Python classes that facilitate the execution of external security scanning utilities.
Evidence: The DependencyScanner class demonstrates the use of subprocess.run to invoke standard, well-known ecosystem tools including npm audit, safety check, govulncheck, and cargo audit to identify vulnerabilities.

security-scanning-security-dependencies