The Agent Skills Directory

[EXTERNAL_DOWNLOADS]: The skill instructs users to install and run the ecc-agentshield package from npm. This package and its source code at github.com/affaan-m/agentshield are provided by a third-party developer who is not included in the trusted vendors list.
[COMMAND_EXECUTION]: The skill provides instructions for executing shell commands, including global package installation and running a tool with the capability to modify local configuration files. It also suggests exporting sensitive API keys to the environment for use by the scanner.
[PROMPT_INJECTION]: The skill processes untrusted data from local configuration files, which presents a surface for indirect prompt injection. * Ingestion points: The scanner reads files such as CLAUDE.md, settings.json, and mcp.json from the .claude/ directory. * Boundary markers: There are no instructions to the AI agent to ignore or delimit instructions found within the audited files. * Capability inventory: The skill has the ability to execute shell commands and modify local files. * Sanitization: The skill does not mention any sanitization or validation of the input file content during the scanning process.

security-scan