The Agent Skills Directory

Package Installation and Execution: The skill uses npx to initialize and run the deepsec tool from a public registry and pnpm to install local dependencies. While fetching and executing code from external registries is a standard part of the development lifecycle for this namesake tool, it is documented as a point of external code ingestion.
Command Execution for Security Auditing: The skill executes shell commands to perform security scans, process AI-assisted results, and export findings. These operations are necessary for the tool's functionality and are performed within the scope of the project's checkout directory.
Indirect Prompt Injection Surface: The agent processes repository content, including documentation and source code, to build analysis context. This creates a surface where instructions embedded in the scanned files could potentially influence the agent. The skill addresses this concern by establishing a policy to avoid running on untrusted source inputs and by applying specific formatting constraints, such as line limits, to the generated context files.

deepsec