The Agent Skills Directory

[DYNAMIC_EXECUTION]: The scripts scripts/secret_scanner.py and scripts/threat_modeler.py use __import__('datetime') within the format_json_report functions to generate timestamps for the reports. This is a benign implementation using a hardcoded, standard library module name.
[DATA_EXFILTRATION]: The scripts/secret_scanner.py utility is designed to identify sensitive information such as API keys and credentials in local files. The script performs local file reads but lacks any network transmission capabilities. Furthermore, it implements safety measures by masking the detected secrets in the output (e.g., showing only the beginning and end of a token) to prevent unintentional exposure in logs.
[INDIRECT_PROMPT_INJECTION]: The skill processes external data by scanning local source code files and accepting component names for threat modeling. This represents an ingestion surface for untrusted data. The risk is assessed as low because the tools are static analyzers that perform pattern matching and risk scoring rather than executing instructions found within the scanned data. The agent is instructed to treat the structured tool output as data for analysis.
Ingestion points: scripts/secret_scanner.py reads local file content; scripts/threat_modeler.py accepts user-defined strings via CLI arguments.
Boundary markers: None explicitly defined in the scripts, though the agent's instructions scope the usage to processing tool reports.
Capability inventory: File system read access in scripts/secret_scanner.py; file system write access in scripts/threat_modeler.py (optional via --output).
Sanitization: scripts/secret_scanner.py implements credential masking in its finding reporting logic.

senior-security