The Agent Skills Directory

[SAFE]: The skill implements legitimate security auditing functionality. The provided Python scripts (find_secrets.py and security_audit.py) perform local file system operations—such as scanning for common secret patterns and writing report templates—that are entirely consistent with the skill's stated purpose.
[SAFE]: No external network operations, remote code downloads, or third-party dependencies were detected. The scripts use only Python's standard library (pathlib, argparse, re, textwrap).
[INDIRECT_PROMPT_INJECTION]: As a code auditing tool, the skill is designed to ingest and process external code. This creates an inherent surface for indirect prompt injection if the audited content contains malicious instructions intended to mislead the agent. However, the skill does not implement unsafe dynamic execution of the audited content, and this risk is inherent to the auditing use case rather than a flaw in the skill's design.

security-auditor