The Agent Skills Directory

[SAFE]: The skill defines a defensive security scanning process across six layers (vulnerable packages, secrets, OWASP patterns, auth, CORS, and data protection). All instructions are consistent with the stated goal of providing a static analysis security audit for .NET applications.
[COMMAND_EXECUTION]: The skill utilizes the standard dotnet list package --vulnerable --include-transitive command. This is a legitimate diagnostic tool provided by the .NET SDK to check for known vulnerabilities (CVEs) in a project's dependency tree and does not present a security risk.
[INDIRECT_PROMPT_INJECTION]: The skill analyzes external data (source code, configuration files, and package manifests) which represents a potential surface for indirect prompt injection. However, the skill employs structured report templates and specific detection patterns for its findings, which reduces the risk of the agent misinterpreting malicious strings within the audited code as new instructions. This is a low-risk inherent to the primary purpose of code auditing and is addressed by the structured analysis process.
[CREDENTIALS_UNSAFE]: While the skill contains regex patterns for detecting secrets (such as AWS keys or Bearer tokens), these are used for identification during an audit rather than for exfiltration. The skill correctly identifies that placeholders like 'your-key-here' and development-only settings should be treated as safe, demonstrating a focus on reducing false positives in a security context.

security-scan