The Agent Skills Directory

[COMMAND_EXECUTION]: The skill contains multiple Python scripts that interface with external security auditing tools using subprocess.run calls. The tools utilized include pip-audit, npm audit, bundle-audit, tfsec, cfn-nag, ansible-lint, kubesec, OWASP ZAP, Nikto, SQLMap, SonarQube, Semgrep, CodeQL, Trivy, Kube-bench, Bandit, and Safety.
Evidence:
scripts/audit_dependencies.py: Executes pip-audit, npm audit, and bundle audit.
scripts/audit_infrastructure.py: Executes tfsec, cfn_nag, ansible-lint, and kubesec.
scripts/dast_scan.py: Executes zap-cli, nikto, and sqlmap.
scripts/sast_scan.py: Executes sonar-scanner, semgrep, and codeql.
scripts/scan_containers.py: Executes docker, trivy, and kube-bench.
scripts/scan_vulnerabilities.py: Executes bandit and safety.
All subprocess calls use list-based arguments without shell=True, which is a security best practice for preventing command injection.
[INDIRECT_PROMPT_INJECTION]: The skill provides an attack surface for indirect prompt injection as it is designed to ingest and process untrusted external data such as source code, infrastructure configurations, and remote website content.
Ingestion points: File paths and URLs provided as arguments to the audit scripts.
Boundary markers: The skill lacks explicit delimiters or boundary instructions when processing external file content or scan results.
Capability inventory: High. The skill has the ability to execute a wide variety of CLI tools and perform network scans.
Sanitization: The scripts perform basic input validation, such as checking for file existence using Path.exists() and verifying URL protocols.

security-auditor