The Agent Skills Directory

[EXTERNAL_DOWNLOADS]: The skill utilizes the Serena semantic analysis tool, which is fetched from its official GitHub repository during execution.
The 1-mcp-resolver agent and analysis documentation specify the use of uvx to run Serena from github.com/oraios/serena.
[INDIRECT_PROMPT_INJECTION]: The skill analyzes untrusted source code, which serves as an ingestion point for potentially malicious data targeting the audit logic.
Ingestion points: Audited code is read from the target repository across multiple phases (Phase 1 through Phase 7) using tools like Grep and Read.
Boundary markers: The skill employs a strict ID namespacing convention (e.g., SO-NNNN for objects, ZA-NNNN for findings) and a structured working directory layout to isolate analysis state.
Capability inventory: The skill leverages Bash for running analysis tools, Write for storing results, and Task for orchestrating parallel sub-agents.
Sanitization: Analysis is performed using deterministic regex and structural LLVM IR parsing. Crucially, the skill includes a mandatory human-in-the-loop checkpoint via AskUserQuestion in Phase 5 to review Proof-of-Concept (PoC) verification failures.
[DYNAMIC_EXECUTION]: The skill generates and executes tailored programs to confirm security findings as part of its primary auditing purpose.
Bespoke PoC programs are generated in Phase 4 using finding-specific metadata and fragments from the audited source code.
These programs are compiled and executed in Phase 5 to confirm exploitability and memory retention issues.
[COMMAND_EXECUTION]: Build tools and specialized analysis scripts are executed throughout the pipeline to inspect the target codebase.
The skill runs standard compiler commands such as clang and cargo rustc, along with analysis scripts like check_rust_asm.py and generate_poc.py, to generate and inspect build artifacts.

zeroize-audit