The Agent Skills Directory

[COMMAND_EXECUTION]: The skill orchestrates Semgrep security scans by executing shell commands via Bash scripts. It interacts with tools including semgrep, git, and jq. The main execution script, scripts/run-scans.sh, includes robust path validation to prevent command injection attacks via user-supplied directory paths.\n- [EXTERNAL_DOWNLOADS]: The skill clones third-party Semgrep rulesets from public GitHub repositories belonging to well-known security organizations (e.g., Trail of Bits, 0xdea, and Decurity). These downloads are required for the skill's intended purpose of comprehensive security auditing. The skill presents a complete list of these rulesets for user approval in Step 3 before execution.\n- [DYNAMIC_EXECUTION]: The skill utilizes uv run to execute the bundled scripts/merge_sarif.py script. This script processes local JSON and SARIF files generated during the scan phase to produce a consolidated report.\n- [INDIRECT_PROMPT_INJECTION]: The skill possesses an indirect prompt injection attack surface as it ingests and processes untrusted source code from the target codebase. \n
Ingestion points: Source code files at the user-defined $TARGET path.\n
Boundary markers: None explicitly defined for findings output, though findings are summarized by category and severity.\n
Capability inventory: Execution of shell commands (Semgrep, Git) and Python-based data merging.\n
Sanitization: Validation of filesystem paths in scripts/run-scans.sh to prevent command injection. The risk is minimized as the skill uses a static analysis engine rather than executing the target code.

semgrep