The Agent Skills Directory

[COMMAND_EXECUTION]: The script scripts/security_scan.py uses the subprocess.run function to execute npm audit. This is a legitimate operation to identify known vulnerabilities in a project's dependency tree.
[EXTERNAL_DOWNLOADS]: The npm audit process inherently requires fetching data from the official npm registry, which is a well-known and trusted external service for package information.
[SAFE]: The logic in scripts/security_scan.py is limited to local file reading and pattern matching. It does not perform unauthorized network operations, maintain persistence, or attempt to bypass security controls.

vulnerability-scanner