The Agent Skills Directory

[EXTERNAL_DOWNLOADS]: The skill's installation script scripts/skill_audit.py attempts to download the gitleaks binary from third-party GitHub proxies such as gh-proxy.com and gh.ddlc.top.
Evidence: mirrors = [f"https://gh-proxy.com/...", f"https://gh.ddlc.top/..."]. One of these URLs was flagged as malicious/phishing by automated scanning tools.
[REMOTE_CODE_EXECUTION]: The downloaded binary is automatically extracted and installed into a system directory, and subsequently invoked by the skill's logic.
Evidence: tf.extractall(path="/usr/local/bin") in scripts/skill_audit.py. This binary is later executed via subprocess in scripts/checks/gitleaks_check.py.
[COMMAND_EXECUTION]: The skill uses subprocess.run with shell=True to execute various system commands, which increases the risk of command injection if parameters are not perfectly sanitized.
Evidence: subprocess.run(shell_cmd, shell=True, capture_output=True, text=True) in scripts/skill_audit.py.
[INDIRECT_PROMPT_INJECTION]: The skill has a large attack surface as it is designed to ingest and process untrusted skill directories, providing an opportunity for indirect prompt injection if the output report influences subsequent agent actions.
Ingestion points: discover_skills function in scripts/skill_audit.py reads all files in the target directory.
Boundary markers: The skill includes logic to detect prompt injection (skillspector rules P1-P5) but lacks explicit escaping for the report generation itself.
Capability inventory: The skill can execute shell commands, write to the file system (reports), and install packages via pip.
Sanitization: Uses shlex.quote for some command arguments, but uses shell=True for execution.

huawei-cloud-skill-audit