The Agent Skills Directory

[COMMAND_EXECUTION]: The skill executes a bundled Python script (scripts/vpc_inventory_audit.py) to perform cloud resource discovery and auditing activities.\n- [DATA_EXFILTRATION]: The script reads sensitive authentication tokens from environment variables or local files. It transmits these credentials to Baidu AI Cloud endpoints to authenticate requests. This behavior is restricted to the official vendor domain (*.baidubce.com) through strict hostname validation.\n- [INDIRECT_PROMPT_INJECTION]: The skill ingests untrusted metadata from Baidu Cloud API responses and user-provided JSON files. This creates an attack surface for indirect prompt injection, as malicious data in the audited cloud environment could attempt to influence the agent's logic. The script implements basic sanitization of Markdown control characters to maintain report integrity.\n- [SAFE]: The tool implements significant security guardrails, including hardcoded enforcement of read-only HTTP GET methods, verification of HTTPS origin hostnames, and validation that local credential files have restricted ownership and permissions (chmod 600).

baiducloud-vpc-inventory-audit