The Agent Skills Directory

[COMMAND_EXECUTION]: The skill uses Bash to perform file searches and execute security auditing tools. This is restricted to standard utilities like grep, cat, and package managers (npm/pip) to analyze the project structure and detect security weaknesses.
[EXTERNAL_DOWNLOADS]: The skill invokes 'npm audit' and 'pip audit' to check for known vulnerabilities. These tools connect to official, well-known package registries (npmjs.com and pypi.org), which is considered safe behavior for security assessments.
[SAFE]: Although the skill scans for sensitive patterns (such as credentials, private keys, and PII), this is a core requirement for a security audit tool. No evidence was found of any attempt to exfiltrate this data or perform any activities outside of its documented penetration testing scope.

pentest-report