The Agent Skills Directory

[COMMAND_EXECUTION]: Executes shell commands including grep, git, npm audit, and trivy to search for hardcoded secrets and identify vulnerabilities within the project structure.
[EXTERNAL_DOWNLOADS]: Fetches and installs the pip-audit package from the official Python Package Index (PyPI) if it is not present in the environment.
[EXTERNAL_DOWNLOADS]: Executes the audit-ci utility using npx, which involves fetching the package from the npm registry to perform security checks on Node.js dependencies.
[PROMPT_INJECTION]: The skill processes untrusted code content from the user's project, creating a surface for indirect prompt injection.
Ingestion points: Local source code files, environment files, and configuration files scanned during audit steps.
Boundary markers: Absent; the instructions do not specify delimiters or warnings to separate code content from the agent's analysis logic.
Capability inventory: File system access via grep, network-reliant dependency audits (npm, pip-audit), and tool installation via pip.
Sanitization: Absent; the skill does not define methods to sanitize or escape code content before it is incorporated into the audit report.

security-audit