The Agent Skills Directory

[COMMAND_EXECUTION]: The script scripts/database_debugger.py uses subprocess.run to call an external command-line tool manus-mcp-cli. It constructs SQL queries using string formatting with unsanitized arguments provided via the command line. This allows for arbitrary SQL execution and poses a risk of unintended database access or modification if used with untrusted inputs.
[DATA_EXFILTRATION]: Multiple documentation files including references/enhanced-error-logging.md, references/lazy-initialization-patterns.md, and scripts/generate_health_endpoint.py promote a practice of logging or exposing the first 7 to 10 characters of sensitive environment variables like STRIPE_SECRET_KEY and SUPABASE_ANON_KEY. Exposing partial credentials in logs or public health endpoints significantly reduces the entropy of secrets and facilitates brute-force attacks.
[DATA_EXFILTRATION]: The guidelines in references/enhanced-error-logging.md advise logging full error details, including stack traces, raw request parameters, and full error objects to the console or client responses. This pattern can inadvertently leak sensitive internal configuration, system architecture details, or user data to unauthorized parties who have access to logs or the API output.
[COMMAND_EXECUTION]: The scripts/generate_health_endpoint.py script generates code that checks and displays the status of environment variables. If integrated into a production service without proper access controls, this diagnostic code could expose the existence and partial values of sensitive tokens to any user who can reach the health endpoint.

serverless-debugging