The Agent Skills Directory

[EXTERNAL_DOWNLOADS]: The skill instructs the user to download and install various third-party security tools from remote repositories and package managers (e.g., opengrep, bandit, trivy, grype, gitleaks).
[REMOTE_CODE_EXECUTION]: The skill includes instructions to download and execute shell scripts directly from the internet using 'curl | sh' for the installation of tools like Trivy (from aquasecurity) and Grype (from anchore). While these are well-known security vendors, piping remote scripts to a shell is a security risk if the source or connection is compromised.
[COMMAND_EXECUTION]: The skill extensively uses subprocess execution for running static analysis (SAST) and software composition analysis (SCA) tools such as bandit, gosec, and opengrep. It also provides templates for creating functional exploit scripts (e.g., 'exploit-cmd-injection.ts') that use 'execSync' to demonstrate command injection impact.
[DATA_EXFILTRATION]: While not directly exfiltrating data, the provided exploit templates (e.g., 'exploit-path-traversal.ts') are specifically designed to read sensitive system files like '/etc/passwd', '.ssh/id_rsa', and '.aws/credentials' to prove vulnerability impact.

security-review