The Agent Skills Directory

[PROMPT_INJECTION] (HIGH): The skill is highly vulnerable to Indirect Prompt Injection because it ingests and processes untrusted data from external sources. \n * Ingestion points: Data enters the agent context via trivy repo (external URLs), trivy image (remote registries), and trivy fs (local filesystem files like package.json).\n * Boundary markers: Absent. There are no instructions or delimiters to prevent the agent from obeying natural language instructions embedded within the scan outputs or source files.\n * Capability inventory: The skill can execute subprocesses including trivy, jq, grep, and custom shell scripts, and can write to the filesystem using cat > .trivyignore.\n * Sanitization: Absent. The agent directly interprets output from these tools, which may contain attacker-controlled content from repository READMEs or metadata.\n- [COMMAND_EXECUTION] (MEDIUM): The skill references and executes local shell scripts (scripts/batch_scan.sh and scripts/compare_versions.sh) that are not provided in the analyzed file, making their logic unverifiable and potentially dangerous.\n- [EXTERNAL_DOWNLOADS] (MEDIUM): The trivy repo command clones and scans arbitrary remote repositories. While a core feature, this provides a direct vector for ingesting malicious content into the agent's environment.

trivy