The Agent Skills Directory

[EXTERNAL_DOWNLOADS]: The skill documents the integration of industry-standard security and accessibility testing tools. Examples include the use of npx @axe-core/cli for accessibility auditing and the manual download of conftest from its official GitHub repository (https://github.com/open-policy-agent/conftest/) for policy-as-code verification. These downloads target well-known, trusted services and are used for their intended auditing purposes.\n- [PRIVILEGE_ESCALATION]: The documentation includes instructions for setting up auditing tools in CI/CD environments, which may involve administrative tasks such as moving binaries to system-wide paths using sudo (e.g., sudo mv conftest /usr/local/bin/). These operations are typical for tool installation and are not indicative of malicious behavior.\n- [DYNAMIC_EXECUTION]: A core feature of the skill is the use of 'Policy as Code' via the Open Policy Agent (OPA). The reference materials provide Rego policy examples designed to be evaluated at runtime to verify compliance with requirements such as access control, encryption, and logging. This dynamic evaluation is essential for automated auditing and follows established industry patterns.\n- [INDIRECT_PROMPT_INJECTION]: As a compliance analyzer, the skill is designed to process project artifacts including source code and configuration files. This creates an inherent attack surface for indirect prompt injection if the audited content contains adversarial instructions. The skill mitigates this risk by providing structured remediation templates and referencing safety guidelines for LLM applications (e.g., OWASP LLM Top 10).

canon