scanning-input-validation-practices

SUSPICIOUS. The skill’s purpose and capabilities mostly align with code security review, and there is no clear credential theft or exfiltration path. However, the actual scanner/plugin is not concretely identified, install provenance is incomplete, and the broad bash security permissions give the agent substantial execution power, making this a medium-risk security skill rather than a benign low-risk guide.

The document contains intentionally vulnerable educational examples of SQL injection, reflected XSS, and unsafe process execution. These are genuine application security risks if deployed, but the supplied fragment does not show malicious supply-chain behavior or hidden malware. The PHP example does not actually connect to a database, and Java Runtime.exec(String) is not a shell invocation by default, although both remain unsafe patterns.