The Agent Skills Directory

[COMMAND_EXECUTION]: The script scripts/audit.py programmatically executes CLI tools including git, npm, and gh to gather project information. These calls are made using subprocess.run with argument lists, which prevents shell injection vulnerabilities. The use of these tools is integral to the skill's stated purpose of project auditing.- [EXTERNAL_DOWNLOADS]: The skill fetches package metadata and tarballs from the NPM registry via HTTPS to compare the published code against the local repository. The source URLs are derived from the official registry, and the skill only reads these files to calculate digests, without executing them.- [DATA_EXFILTRATION]: While the skill accesses sensitive files (like .env) and scans for credentials, it explicitly redacts all secret values. The resulting reports (HTML and JSON) only contain the location and category of findings, ensuring no sensitive data is exposed in the output.

project-audit