The Agent Skills Directory

[EXTERNAL_DOWNLOADS]: The skill fetches an installation script for the wraith binary from the vendor's official GitHub repository (https://raw.githubusercontent.com/ghostsecurity/wraith/main/scripts/install.sh).
[REMOTE_CODE_EXECUTION]: The initialization agent executes the downloaded vendor script directly via the shell to set up the environment.
[COMMAND_EXECUTION]: The skill uses the Bash tool to run the wraith scanner on discovered lockfiles and to compute project-specific hashes.
[INDIRECT_PROMPT_INJECTION]: The skill ingests untrusted data from the repository being scanned, including lockfile paths, lockfile contents, and source code files, to perform its analysis.
Ingestion points: Files are discovered by the Glob tool and their content is read via Grep or Read in the discover and analyze agents.
Boundary markers: The instructions do not define explicit boundary markers or "ignore instructions" directives when processing these files.
Capability inventory: The skill possesses shell execution capabilities (Bash tool) and the ability to spawn subagents (Task tool) which receive data from the processed files.
Sanitization: There is no explicit sanitization or validation of the content read from the repository before it is processed by the AI subagents.

ghost-scan-deps