The Agent Skills Directory

[COMMAND_EXECUTION]: The Python script inventory.py executes external binaries to interact with cloud provider APIs and local secret management tools. Evidence: The script uses subprocess.run() with list-based arguments to call the aws CLI for infrastructure metadata and Cost Explorer queries, the op (1Password) CLI to securely retrieve API tokens into memory, and curl for other API interactions. This method is a secure way to invoke system tools as it prevents shell injection by not invoking a shell for command parsing.\n- [EXTERNAL_DOWNLOADS]: The skill performs network operations to retrieve resource metadata and billing information from third-party services. Evidence: The script uses curl to query api.cloudflare.com for account subscriptions and worker information, and api.twilio.com for usage records. These are well-known, trusted service providers, and all requests are authenticated using credentials retrieved from the user's secure vault.\n- [INDIRECT_PROMPT_INJECTION]: The skill ingests data from a local CSV file (components.csv) and uses its values to drive automated API lookups. 1. Ingestion points: Reads components.csv via the read_ledger function in scripts/inventory.py. 2. Boundary markers: None; the CSV is treated as a trusted local record of infrastructure. 3. Capability inventory: Subprocess calls to aws, curl, and op. 4. Sanitization: The script utilizes list-based subprocess calls rather than string-based shell execution, which prevents fields in the CSV (such as resource_id) from being interpreted as shell commands.

component-inventory