The Agent Skills Directory

[COMMAND_EXECUTION]: The script scripts/security_scan.py uses subprocess.run to execute npm audit. This is a standard, documented operation for verifying the security of project dependencies and is used here in a controlled manner.\n- [INDIRECT_PROMPT_INJECTION]: The skill is designed to ingest and analyze external project files, which creates an indirect prompt injection surface.\n
Ingestion points: The scripts/security_scan.py script traverses and reads files from a user-provided project path.\n
Boundary markers: No specific delimiters are used to wrap the untrusted file content during scanning.\n
Capability inventory: The skill has the ability to read local files, traverse directories, and execute the npm CLI tool.\n
Sanitization: The script uses regular expressions for static analysis and does not execute the contents of the files it scans, which significantly limits the risk.\n- [SAFE]: The skill's behavior is entirely consistent with its stated purpose as a security tool. It does not perform unauthorized network requests, exfiltrate credentials, or employ obfuscation techniques to hide its intent.

vulnerability-scanner