The Agent Skills Directory

[COMMAND_EXECUTION]: The skill facilitates the execution of local repository scripts (lint, test, build) and external audit tools such as scorecard, gitleaks, osv-scanner, and pip-audit. These operations are well-scoped to the skill's primary purpose of repository auditing and use reputable, well-known developer tools.
[INDIRECT_PROMPT_INJECTION]: The agent is designed to ingest and analyze untrusted data from external repositories (e.g., source code, README files, CI configurations). While this presents an attack surface where a repository could contain malicious instructions, the skill includes explicit constraints and 'stop rules' that require the agent to ground findings in verifiable code evidence (file:line), mitigating the risk of following adversarial instructions.
[EXTERNAL_DOWNLOADS]: The skill references several external security and quality tools. These tools (e.g., OpenSSF Scorecard, Google's osv-scanner, REUSE) originate from trusted organizations and well-known open-source maintainers, representing standard development practices rather than a security risk.

quality-audit