The Agent Skills Directory

[COMMAND_EXECUTION]: The script scripts/security_scan.py utilizes subprocess.run to execute the npm audit command for dependency vulnerability scanning. This is a standard and expected operation for a security tool and is implemented using secure practices by passing arguments as a list without a shell.
[EXTERNAL_DOWNLOADS]: The skill references the use of established security tools like npm audit, which interact with official package registries to retrieve vulnerability metadata. This is consistent with the skill's primary purpose and targets well-known services.
[SAFE]: The local filesystem scanning performed by scripts/security_scan.py to identify potential hardcoded secrets or dangerous code patterns is a read-only operation. The findings are reported directly to the user's console, and there is no evidence of unauthorized data exfiltration or credential theft.

vulnerability-scanner