The Agent Skills Directory

[COMMAND_EXECUTION]: The skill uses gh api to fetch Dependabot alerts and manage pull requests, gcloud artifacts to query GCP container vulnerabilities, and docker scout for public image security scanning. These are standard administrative actions for the stated purpose of the skill.- [EXTERNAL_DOWNLOADS]: Fetches security alert data and recommendations from GitHub, Google Cloud Platform, and Docker Hub. It also references external advisories from NVD and the GitHub Advisory Database for triage purposes.- [INDIRECT_PROMPT_INJECTION]: The skill ingests untrusted data from external sources including vulnerability summaries, package metadata, and Linear issue descriptions. This creates a surface for indirect prompt injection where malicious instructions embedded in security advisories could potentially influence the agent during triage or PR creation. Evidence: Ingestion points include gh api output, gcloud logs, and Linear issue titles/descriptions; no specific boundary markers or sanitization logic is defined for processing these external strings; the skill has capabilities to modify dependency manifests and create PRs.

triage-vulnerabilities