The Agent Skills Directory

[COMMAND_EXECUTION]: The skill executes various shell commands including grep, sed, mkdir, and tee to create directories, search for patterns in the codebase, and generate reports.
[DYNAMIC_EXECUTION]: The skill uses python3 -c to execute a short Python script that parses JSON output from the Semgrep tool. This is used for extracting path and line information from scan results.
[INDIRECT_PROMPT_INJECTION]: The skill exhibits an indirect prompt injection attack surface as it processes untrusted data from an external codebase.
Ingestion points: The skill reads all files matching the specified extensions within the directory provided in SECSKILL_SCAN_PATH.
Boundary markers: There are no explicit instructions or delimiters used to warn the agent about potentially malicious instructions embedded in the scanned files.
Capability inventory: The skill has the capability to execute shell commands, read/write files, and execute Python scripts via bash.
Sanitization: While it attempts to mask hardcoded credentials using sed, other code snippets containing potentially malicious instructions for the LLM are printed raw in the output report.
[EXTERNAL_DOWNLOADS]: The skill recommends installing the semgrep package from the Python Package Index (PyPI) and fetches security rules from Semgrep's official registry during execution.

insecure-defaults