The Agent Skills Directory

[COMMAND_EXECUTION]: The script scripts/src/run_analysis.ts is vulnerable to command injection. The taskId parameter, obtained directly from process arguments, is interpolated into a shell command string executed via execAsync without any sanitization or validation. A maliciously crafted taskId (e.g., including shell metacharacters like ; or &&) would allow an attacker to execute arbitrary commands on the system.
[SAFE]: The skill's network-requesting scripts globally disable SSL/TLS certificate validation by setting rejectUnauthorized: false in https.Agent configurations. While this is a poor security practice that exposes data to man-in-the-middle attacks, it is documented as a best practice violation rather than a confirmed exploit.

byted-security-llmscanner