The Agent Skills Directory

[COMMAND_EXECUTION]: The script scripts/security_scan.py invokes system commands via subprocess.run to facilitate security auditing. Specifically, it calls npm audit to retrieve vulnerability reports for JavaScript dependencies. This execution is confined to a fixed command list and is a core functional requirement of the tool's auditing capabilities.
[EXTERNAL_DOWNLOADS]: The dependency scanner within scripts/security_scan.py is capable of communicating with the npm registry to validate package security. This external network interaction is opt-in, requiring the user to provide the --allow-network flag, and is consistent with the skill's purpose as a supply chain security tool.
[INDIRECT_PROMPT_INJECTION]: The tool ingests untrusted code from local directories to identify vulnerabilities. This represents a potential surface for indirect prompt injection if a malicious file contains instructions designed to mislead the agent. The skill mitigates this risk by producing structured JSON output and explicitly omitting raw code snippets from its findings to prevent the reflection of sensitive or malicious data into the agent's context.

vulnerability-scanner