The Agent Skills Directory

[COMMAND_EXECUTION]: The skill provides numerous shell commands utilizing git and rg (ripgrep) to analyze code history, identify entry points, and search for vulnerability patterns in the local repository.
[COMMAND_EXECUTION]: Recommends the execution of well-known, specialized security scanners including semgrep, bandit, gosec, tfsec, and trivy to automate the discovery of security defects.
[PROMPT_INJECTION]: The skill is designed to ingest and analyze untrusted source code. While this inherently involves processing data from potentially malicious sources, the skill mitigates risk by instructing the agent to follow a multi-pass verification methodology and by using tools that operate on local file content rather than executing it.
[SAFE]: The methodology encourages best practices such as building threat models, verifying findings before reporting, and performing variant analysis to identify related bugs.

auditing-code-for-vulnerabilities