The Agent Skills Directory

[EXTERNAL_DOWNLOADS]: The skill provides examples of using third-party services like polyfill.io for browser compatibility and securityheaders.com for testing, which are treated as references to well-known developer services.
[COMMAND_EXECUTION]: Instructs the agent on how to use standard package manager tools such as npm audit and yarn audit to identify and fix vulnerabilities in project dependencies.
[INDIRECT_PROMPT_INJECTION]: The skill is intended to review and audit user-provided code, creating a surface where malicious code could influence the agent's behavior.
Ingestion points: The skill is triggered during security audits or code reviews of user-provided source files as specified in the metadata description.
Boundary markers: The skill does not define specific delimiters or instructions to prevent the agent from executing instructions embedded within the code being reviewed.
Capability inventory: The instructions involve the use of terminal commands and file system checks, which could be abused if the agent is misled by malicious input.
Sanitization: There are no explicit instructions for the agent to sanitize or escape external content before processing it as part of the audit workflow.
[SAFE]: The primary purpose of the skill is educational and aligns with established industry standards like OWASP and MDN security guidelines.

best-practices