The Agent Skills Directory

[EXTERNAL_DOWNLOADS]: The skill installs the gosec security scanner from its official repository on GitHub (github.com/securego/gosec). This is a standard and expected operation for obtaining this specific security tool.- [COMMAND_EXECUTION]: The skill instructs the agent to execute shell commands to run the scanner, such as gosec -fmt=json -out=gosec-results.json ./.... These commands are standard for the tool's intended use.- [INDIRECT_PROMPT_INJECTION]: The skill processes external Go source code, which serves as an untrusted data ingestion point (identified in SKILL.md instructions). There are no explicit boundary markers or sanitization steps mentioned to prevent malicious code comments from influencing the agent's analysis, although the structured JSON output from the tool provides some inherent isolation. The agent has capabilities to read files and execute commands to perform its task.

sast-gosec