The Agent Skills Directory

[COMMAND_EXECUTION]: The skill includes a Python implementation MultiLanguageSASTScanner that utilizes subprocess.run to invoke external security scanners (Semgrep, Bandit, ESLint) on a specified local directory.
[EXTERNAL_DOWNLOADS]: The documentation provides instructions for installing standardized security scanning packages from official registries, including bandit and semgrep via pip, and @eslint/plugin-security via npm.
[COMMAND_EXECUTION]: The skill provides numerous shell command examples for running language-specific security tools such as gosec for Go, brakeman for Ruby, and cargo clippy for Rust.
[INDIRECT_PROMPT_INJECTION]: The scanner is designed to ingest and analyze untrusted source code. While the skill focuses on scanning rather than execution, there is an inherent surface where malicious patterns in the analyzed code could attempt to influence the agent's summary or triage of findings.
Ingestion points: Reads files from a local project directory using pathlib.Path.glob and scanner output via subprocess.run (SKILL.md).
Boundary markers: The instructions advise triaging findings and requiring human review before taking action, which serves as a manual boundary.
Capability inventory: The skill uses subprocess.run to execute scanners and json.loads to process their reports.
Sanitization: The skill relies on the internal logic of standard SAST tools to parse source code safely.

security-scanning-security-sast