feat(agent-scan): add new security detection skills

[NY1024]

Summary

• Add new skill definitions for ASI04–ASI09 to the agent-scan prompt skills library
• Introduce detection guidance and output templates for supply chain, code execution, inter-agent comms, cascading failures, and human
  trust exploits
• Align new skills with existing SKILL.md format and conventions

Changes

• agent-scan/prompt/skills/agentic-supply-chain-detection/SKILL.md
• agent-scan/prompt/skills/unexpected-code-execution-detection/SKILL.md
• agent-scan/prompt/skills/inter-agent-comm-security-detection/SKILL.md
• agent-scan/prompt/skills/cascading-failure-detection/SKILL.md
• agent-scan/prompt/skills/human-agent-trust-exploit-detection/SKILL.md

[boy-hack]

Code Review

Thank you for contributing 5 new OWASP ASI detection skills (ASI04–ASI09)! The skill content quality is good and aligns well with the existing SKILL.md format.

⚠️ Required Fix: Skills Not Registered in _DETECTION_SKILLS

The 5 new skills added in this PR are not registered in agent-scan/core/agent.py — which means they will not be executed during agent scans.

Please update _DETECTION_SKILLS in agent-scan/core/agent.py to include the new skills:

_DETECTION_SKILLS: List[str] = [
    "data-leakage-detection",
    "tool-abuse-detection",
    "indirect-injection-detection",
    "authorization-bypass-detection",
    # Add the new skills:
    "agentic-supply-chain-detection",
    "unexpected-code-execution-detection",
    "inter-agent-comm-security-detection",
    "cascading-failure-detection",
    "human-agent-trust-exploit-detection",
]

Reference: PR #429 by @DevamShah is a good example — it correctly adds both the SKILL.md file and the registration in agent.py simultaneously.

Minor Notes

• cascading-failure-detection maps to ASI08 and human-agent-trust-exploit-detection maps to ASI09 — consider also updating agent-scan/prompt/skills/owasp-asi/SKILL.md to add the mapping entries for these new skills (similar to what PR feat(agent-scan): add memory/RAG poisoning detection skill #429 did for memory-rag-poisoning-detection).
• The skill content itself looks solid — good test probe variety and clear Vulnerable/Safe judgment criteria.

Please address the agent.py registration issue and we can move forward with merge. 🙏

[NY1024]

Thanks for the review and for pointing this out.

I’ve updated agent-scan/core/agent.py to register the new detection skills in _DETECTION_SKILLS, and also added the missing mappings in SKILL.md.

The PR has been updated accordingly. Please take another look.