The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill is designed to ingest and interpret data from external SARIF files, which may contain third-party content such as rule descriptions or result messages. This presents a surface where content from scan results could influence agent behavior if interpreted as instructions.
Ingestion points: resources/sarif_helpers.py and SKILL.md (Strategy 1-5).
Boundary markers: Not explicitly implemented, though the skill provides structured data handling and path normalization.
Capability inventory: The skill is authorized to use the Bash tool and references scripts that utilize subprocess.run calls.
Sanitization: Employs path normalization and URI decoding in resources/sarif_helpers.py to ensure consistent data handling.
[COMMAND_EXECUTION]: The test suite resources/test_sarif_helpers.py uses subprocess.run to execute the jq utility. This allows for automated verification of documented query templates against test fixtures.
[DYNAMIC_EXECUTION]: The documentation and helper scripts construct jq filter expressions dynamically by concatenating a resolution function with specific queries. These expressions are then evaluated at runtime to process SARIF datasets.
[EXTERNAL_DOWNLOADS]: The skill recommends the installation of several external security tools and libraries, including sarif-tools (from Microsoft's GitHub), pysarif, ijson, jsonschema, and ajv-cli. It also mentions the garif utility from a third-party GitHub repository.

sarif-parsing