The Agent Skills Directory

[COMMAND_EXECUTION]: The collect_graph function in scripts/generate.py uses subprocess.run to execute a CLI tool (graph_cli.py). The path to this executable is constructed using the --target CLI argument, which allows for command execution from paths influenced by user input.
[REMOTE_CODE_EXECUTION]: The skill implements a load_module function that utilizes importlib.util to dynamically execute Python scripts (tickets.py, graph_core.py, runtime_doctor.py). These scripts are loaded from locations relative to the --target directory, creating a vulnerability where an attacker could achieve code execution by providing a path to a directory containing malicious versions of these files.
[EXTERNAL_DOWNLOADS]: The generated HTML dashboard references the vis-network library hosted on unpkg.com. This is a well-known CDN service used for front-end asset delivery.
[DATA_EXPOSURE]: The script contains logic to read and parse .env and .env.local files to extract the DATABASE_URL. While this is a standard practice for local configuration, the agent processes these files to establish database connections, exposing connection strings and credentials to the execution environment.

skill-system-dashboard