The Agent Skills Directory

[COMMAND_EXECUTION]: The skill uses shell commands including git clone to retrieve repository content, grep or ripgrep for static analysis, and rm -rf for cleaning up temporary files in /tmp after assessment.
[EXTERNAL_DOWNLOADS]: The skill performs network operations to fetch metadata from the GitHub API (api.github.com) and clones external repositories from user-provided URLs for analysis.
[PROMPT_INJECTION]: The skill is designed to ingest and process untrusted data from third-party repositories, creating a surface for indirect prompt injection. The skill's documentation explicitly acknowledges this risk, noting that a weaponized README could attempt to hijack the scanning agent, and recommends using sandboxed sub-agents with restricted capabilities for processing natural language content.

oss-security-check