The Agent Skills Directory

[SAFE]: The skill functions as a comprehensive documentation and process framework for AI agents to conduct adversarial Python security audits. It defines a structured methodology for identifying vulnerabilities using OpenSSF principles and CWE mappings.- [INDIRECT_PROMPT_INJECTION]: The skill is designed to ingest and analyze untrusted Python source code from repositories or decompiled artifacts. While processing untrusted data presents an inherent attack surface for indirect prompt injection, the skill defines a rigorous verification process, and the behavior is essential to its primary function as a security auditing tool.- [DYNAMIC_EXECUTION]: Instructions guide the agent to generate standalone Proof-of-Concept (PoC) scripts (poc_*.py) to validate findings. This involves local script generation and syntax validation within the agent's workspace, which is a standard procedure for security analysis skills and does not involve downloading or executing remote code.- [COMMAND_EXECUTION]: The reference files include numerous examples of rg (ripgrep) commands. These are provided as search anchors to help the agent locate high-risk sinks (like subprocess.run or pickle.load) within the code being audited, rather than executing these dangerous commands themselves.

openssf-python-review