The Agent Skills Directory

[SAFE]: The skill contains instructional guidelines for security auditing and does not include any malicious scripts, persistence mechanisms, or unauthorized network operations. References to external tools like npm audit, pip audit, trivy, and snyk are standard security practices.
[INDIRECT_PROMPT_INJECTION]: The skill is designed to process and analyze untrusted codebase content, presenting a surface for indirect prompt injection common to all code analysis tools.
Ingestion points: Processes user-provided source files, configuration files (e.g., .env, config.json), and dependency manifests (SKILL.md).
Boundary markers: Absent; the instructions do not specify delimiters or specialized prompts to isolate the analyzed code from the agent's primary instructions.
Capability inventory: The skill is limited to textual analysis and report generation; no file-write, network exfiltration, or arbitrary code execution capabilities are defined or requested.
Sanitization: Absent; the skill does not instruct the agent to sanitize or escape the content of the files being audited before analysis.

auditing-security