The Agent Skills Directory

[EXTERNAL_DOWNLOADS]: The skill clones third-party security rulesets from external GitHub repositories (e.g., Trail of Bits, 0xdea, Decurity) to enhance scan coverage. These sources are well-known security research organizations or infrastructure providers.
[COMMAND_EXECUTION]: The skill utilizes the Bash tool to execute git for cloning rulesets and Semgrep for code analysis. This is essential for the skill's core functionality of static analysis and is governed by explicit user approval instructions.
[INDIRECT_PROMPT_INJECTION]: As a static analysis tool, the skill processes codebases which could theoretically contain malicious patterns designed to influence the scanner or the agent's interpretation of results. The skill mitigates this through a structured workflow and a hard approval gate for the scanning plan.
Ingestion points: Files within the user-provided target directory are analyzed via Glob and Read tools.
Boundary markers: The workflow uses dedicated plan files (rulesets.json) and manifests (scans.json) to strictly define and track the scan scope.
Capability inventory: Employs Bash for shell commands, Read for file inspection, and the Semgrep binary for analysis across multiple scripts.
Sanitization: Results are merged into a SARIF file; the skill logic performs aggregation and deduplication without executing the target code.
[DYNAMIC_EXECUTION]: The companion test script (scripts/test_merge_sarif.py) uses subprocess.run to execute the Semgrep binary in a controlled test environment to verify the SARIF merging logic.

semgrep