The Agent Skills Directory

[SAFE]: The automated scan flagged remote code execution patterns (curl ... | sh). These patterns are located in tests/test_scan_skill.py within a string literal used for a unit test (test_rejects_download_execute_and_secret_assignment_without_echoing_values). This is a legitimate and safe use case to ensure the scanner's detection logic functions correctly.
[COMMAND_EXECUTION]: The skill provides the agent with the ability to execute its scanning script (scripts/scan_skill.py). The script performs read-only operations on a target directory to match security patterns against a list of regular expressions. It does not execute the files it scans.
[DATA_EXFILTRATION]: The skill is designed to prevent data exposure. Both the README.md and SKILL.md emphasize that the tool should only report the type and location of findings, explicitly forbidding the echoing of sensitive content like API keys or private tokens.
[SAFE]: All dependencies used in the Python script (argparse, json, re, pathlib, etc.) are standard Python libraries. No external third-party packages are required.

skill-scanner