The Agent Skills Directory

[COMMAND_EXECUTION]: The skill utilizes established security assessment tools including npm audit, pip-audit, osv-scanner, trivy, and gitleaks. These tools are executed locally to identify vulnerabilities, dependency issues, and hardcoded secrets within a project's source code.
[DATA_EXPOSURE]: Provides specific search patterns for common sensitive credentials such as AWS keys, Stripe tokens, and GitHub personal access tokens. It includes a critical safety instruction to never display the full secret in the final audit report, requiring the agent to mask all but the first few characters.
[INDIRECT_PROMPT_INJECTION]: By design, the skill ingests and analyzes untrusted data in the form of third-party source code and configuration files. While this represents a potential attack surface, the instructions guide the agent to perform static analysis and reporting rather than interpreting the scanned content as executable instructions.

security-audit