The Agent Skills Directory

[COMMAND_EXECUTION]: The script scripts/process.py executes the in-toto-verify CLI tool using the subprocess module. These calls use a list of arguments without a shell environment, which follows security best practices to prevent command injection.
[EXTERNAL_DOWNLOADS]: The scripts/agent.py script performs network requests to user-defined target URLs for security status and compliance auditing. These operations are essential for the tool's intended functionality and do not exhibit signs of data exfiltration.
[SAFE]: The documentation in references/api-reference.md mistakenly suggests installing the subprocess module via pip. Since subprocess is a standard Python library, this is considered a documentation oversight rather than a security risk.

implementing-supply-chain-security-with-in-toto