The Agent Skills Directory

[EXTERNAL_DOWNLOADS]: The skill instructs the agent to download and install several security tools from established repositories and well-known services. These include Syft from Anchore's GitHub, OSV-Scanner from Google's GitHub, and Cosign from Sigstore's GitHub. These are recognized sources within the security community and are used here for their intended defensive purposes.
[COMMAND_EXECUTION]: The skill frequently executes command-line utilities for security assessment purposes. These include running scanners like Trivy for image audits, Gitleaks for secret detection, and Syft for generating Software Bill of Materials (SBOM). These operations are essential to the skill's primary function of security testing.
[INDIRECT_PROMPT_INJECTION]: The skill possesses an attack surface for indirect prompt injection as it is designed to ingest and analyze untrusted data from external sources, such as third-party scan results, dependency trees, and Proof of Concept (PoC) code for vulnerability reachability.
Ingestion points: Vulnerability scan reports (OSV/Trivy), SBOM files (bom.json), CI/CD pipeline configurations, and external PoC exploit code analyzed during reachability verification (documented in SKILL.md and references/sbom-sca-methodology.md).
Boundary markers: None identified in the prompt templates; the agent is expected to analyze the raw data provided by tools.
Capability inventory: The skill can write files (bom.json), perform network operations (uploading results to an OWASP Dependency-Track instance), and execute various local security binary tools.
Sanitization: No explicit sanitization or filtering of the ingested scan data is mentioned before it is processed by the agent.
Assessment: Given the skill's specific purpose is defensive auditing, this ingestion is necessary and intended. The inherent risk is documented but does not escalate the verdict.

supply-chain-security