The Agent Skills Directory

[SAFE]: The skill's behavior is consistent with its stated purpose of assisting in security code reviews. No malicious intent, exfiltration, or unauthorized command execution patterns were found.
[NO_CODE]: The skill does not contain any executable Python or JavaScript files. It consists solely of Markdown-based reference guides and instructions.
[PROMPT_INJECTION]: The skill presents an inherent surface for indirect prompt injection because it is designed to ingest and analyze untrusted user-provided code. Ingestion points: Code files are accessed using Read, Grep, and Glob tools. Boundary markers: No specific delimiters are used to isolate untrusted input. Capability inventory: The agent has access to Bash and Task tools. Sanitization: No automated sanitization is applied to input code; however, the agent is explicitly instructed to distinguish between auditing research and executable findings.
[EXTERNAL_DOWNLOADS]: The documentation references external security testing tools such as ysoserial.net. While identified as a source of security testing payloads, its inclusion here is for informational reference within a security auditing context and does not involve automated downloads or execution by the agent.

security-review