The Agent Skills Directory

[COMMAND_EXECUTION]: The skill provides scripts (scripts/secrets-scanner.sh, scripts/security-audit-checklist.py) that perform file system scanning using grep, find, and git to identify security vulnerabilities such as leaked credentials and insecure code patterns.
[PROMPT_INJECTION]: There is a surface for indirect prompt injection as the skill is designed to audit untrusted project files.
Ingestion points: The scripts read source and configuration files within the user-provided project directory.
Boundary markers: No specific boundary markers or instruction isolation techniques are used to separate untrusted file content from the agent's reporting logic.
Capability inventory: The skill possesses read-only scanning capabilities; no network exfiltration or destructive file operations are implemented in the included scripts.
Sanitization: File content is analyzed via regex and reported but not sanitized before being presented to the agent.
[EXTERNAL_DOWNLOADS]: The skill documentation recommends the installation and use of well-known third-party security tools like trivy, snyk, trufflehog, and gitleaks from reputable providers.
[SAFE]: Homoglyph characters (e.g., Cyrillic 'о' in gооgle.com) found in the documentation are used exclusively as educational examples for explaining Internationalized Domain Name (IDN) homograph attacks and do not represent a security risk.

israeli-appsec-scanner