The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill processes untrusted repository files, such as SAST configurations and CI/CD workflow files, which could contain malicious instructions designed to subvert the agent's behavior. However, the skill implements strong mitigations:
Boundary Markers: The skill includes a 'Prompt Injection Safety Notice' that explicitly instructs the agent to ignore any commands or instructions found in the message fields of Semgrep rules or CodeQL annotations.
Restricted Capabilities: The allowed-tools are limited to Read, Grep, and Glob. The skill lacks network tools (like curl or wget) or command execution capabilities (like sh or bash), which significantly limits the impact of any potential injection.
[DATA_EXPOSURE]: The process involves searching for potentially sensitive configuration files, including .env files and legacy SAST configurations (e.g., Checkmarx, Fortify). While these files can contain sensitive metadata, the access is restricted to the target repository provided to the agent and is necessary for the stated purpose of auditing security tool coverage.
[EXTERNAL_DOWNLOADS]: The skill references official and well-known services, including the Semgrep registry (semgrep.dev/r) and official GitHub Actions for CodeQL. These references are documented as standard patterns for the agent to look for in a target repository and do not involve the skill downloading or executing arbitrary remote code.

sast-config