The Agent Skills Directory

[REMOTE_CODE_EXECUTION]: Automated security scanners flagged a command in runbook_scaffolder.py as remote code execution. Manual review confirms this is a false positive; the command curl ... -o /dev/null is a standard health check used to verify service availability by checking HTTP status codes, and it does not execute any downloaded content. Similarly, templates for smoke tests using curl | jq are standard practices for verifying API responses.\n- [COMMAND_EXECUTION]: The staleness_checker.py and runbook_validator.py scripts utilize subprocess.run to interact with the git command-line interface. These implementations use list-based arguments, which is a recommended security practice to prevent shell injection. These tools are intended for local development environments to check runbook freshness and quality.\n- [INDIRECT_PROMPT_INJECTION]: The skill ingests service definitions via JSON to populate runbook templates. While this accepts external input, the risk is limited to the content of the generated markdown files. The inclusion of runbook_validator.py allows users and agents to audit these generated files for placeholders or hardcoded secrets before they are adopted.

runbook-generator