The Agent Skills Directory

[COMMAND_EXECUTION]: The script scripts/audit.py utilizes subprocess.run to execute local CLI utilities such as git, npm, and gh. These commands are used to discover project structure, check for uncommitted changes, and retrieve CI run history, which is consistent with the skill's stated purpose.
[EXTERNAL_DOWNLOADS]: The channel-divergence probe fetches package tarballs from the official npm registry (registry.npmjs.org) using urllib.request. This is done specifically to compare the published artifacts against the local source code to ensure they have not diverged, a security-positive integrity check.
[DATA_EXPOSURE_AND_EXFILTRATION]: While the skill contains a scanner for hardcoded credentials (e.g., NPM tokens, AWS keys), it follows security best practices by explicitly redacting the values from all outputs and reports, preventing the accidental exposure of discovered secrets.
[SAFE]: The project uses only standard Python libraries and avoids shell execution (shell=True) in its subprocess calls, significantly reducing the risk of command injection or dependency-related supply chain attacks.

project-audit