The Agent Skills Directory

[SAFE]: The skill provides comprehensive and legitimate guidance for building security testing pipelines using industry-standard tools like Semgrep, CodeQL, Trivy, and OWASP ZAP.
[SAFE]: The Python utility scripts/vuln_tracker.py is a dependency-free script that calculates security posture scores and generates Markdown reports. It does not perform network operations or execute arbitrary commands.
[SAFE]: Reference materials and data files (sample-vulnerabilities.json) contain mock data and links to reputable security vendors and documentation sources.
[SAFE]: The script scripts/vuln_tracker.py contains an indirect prompt injection attack surface as it ingests untrusted JSON data from user-defined paths; however, it lacks exploitable capabilities (no network egress, no subprocess execution, and limited file system write access) and does not interpolate the data into agent instructions.
Ingestion points: scripts/vuln_tracker.py reads JSON from paths provided via CLI arguments.
Boundary markers: Absent.
Capability inventory: The script can print to standard output or write a Markdown report to a local file path specified by the user. It has no network or command execution capabilities.
Sanitization: Input JSON is parsed via the standard json library; field values are formatted into text output without specific sanitization.

qa-security-testing