The Agent Skills Directory

[COMMAND_EXECUTION]: The skill instructs the agent to execute multiple common security analysis tools, including semgrep, npm audit, pip-audit, govulncheck, cargo audit, and trivy. These tools are used to perform static analysis and dependency auditing on the current working directory.
[EXTERNAL_DOWNLOADS]: Several of the security auditing tools mentioned (such as trivy and npm audit) inherently download vulnerability database updates and security advisories from official registries and well-known repositories to maintain up-to-date scanning capabilities.
[SAFE]: The skill implements strong safety boundaries by explicitly instructing the agent to perform a read-only inspection, preventing it from modifying the code being audited. It also provides a structured framework for triaging results and documenting false positives.

yds-vulnerability-scan