The Agent Skills Directory

[COMMAND_EXECUTION]: The skill uses shell commands including npm audit, pip-audit, trivy, and grep to scan the codebase for vulnerabilities and secrets.
[EXTERNAL_DOWNLOADS]: Installs the pip-audit package from the Python Package Index (PyPI) and uses npx to run audit-ci, which may download the package if not cached locally.
[INDIRECT_PROMPT_INJECTION]: The skill processes untrusted external data (project source code) which could contain malicious instructions designed to influence the agent's behavior during the audit process.
Ingestion points: Project source files (js, ts, py, java, go, rb, env, yml, yaml, json, xml, conf), configuration files, and dependency manifests.
Boundary markers: No specific delimiters or "ignore instructions" warnings are used when processing the ingested file content.
Capability inventory: Access to shell commands (grep, npm, pip, trivy, git) and the ability to read arbitrary files within the project directory.
Sanitization: No sanitization or filtering of the ingested file content is performed before processing.

security-audit