The Agent Skills Directory

[EXTERNAL_DOWNLOADS]: The skill provides instructions for installing and integrating security auditing tools from well-known and reputable sources.
Mentions pip install pip-audit and npm audit for dependency scanning in CI/CD pipelines.
References official GitHub repositories for security tools, including Yelp/detect-secrets, gitleaks/gitleaks, and aquasecurity/trivy-action.
[COMMAND_EXECUTION]: The instructions include various command-line utilities for security auditing and code analysis.
Provides rg (ripgrep) patterns for detecting hardcoded secrets and potential injection vulnerabilities in source code.
Recommends the use of binary security scanners such as trufflehog, gitleaks, and trivy for filesystem and image scanning.
[INDIRECT_PROMPT_INJECTION]: The skill provides code templates for APIs that process external data, establishing an attack surface that is mitigated by the included validation logic.
Ingestion points: Request bodies in FastAPI and Express templates (req.body), file uploads via UploadFile in SKILL.md, and search query parameters (q: str).
Boundary markers: Recommends the implementation of strict data schemas using Pydantic and Zod to define clear boundaries for untrusted input.
Capability inventory: The templates interact with databases (db.execute, db.query), the local filesystem (os.path.basename, file.read), and external cloud secret managers (AWS and GCP).
Sanitization: Demonstrates robust sanitization practices, including Pydantic with strict=True, regex-based validation for string fields, and filename sanitization for file uploads.
[SAFE]: The primary function of this skill is to provide security hardening guidance. All technical operations, external references, and data handling patterns align with industry-standard security practices and are intended to improve the security posture of the user's application.

production-security