The Agent Skills Directory

[DYNAMIC_EXECUTION]: The script scripts/generate_report.py contains a generate_script method that constructs a Bash script by concatenating a hardcoded header with a string template provided via the --content argument. This allows for the runtime creation of executable shell scripts from arbitrary text inputs.
[PRIVILEGE_ESCALATION]: In scripts/generate_report.py, the generate_script function explicitly calls file_path.chmod(0o755) on the newly created script files. This grants execution permissions to dynamically generated content, which is a high-risk operation if the content source is not strictly validated.
[INDIRECT_PROMPT_INJECTION]: The skill is designed to ingest and analyze external codebases and infrastructure configurations (e.g., Terraform or CloudFormation files). There is a risk that malicious instructions embedded in these external targets could influence the agent's output, which is then used as the source content for script generation.
Ingestion points: Target codebases, configuration files, and infrastructure resources analyzed during the PCI-DSS validation process as described in SKILL.md.
Boundary markers: No specific boundary markers or instructions to ignore embedded instructions are implemented in the instructions or the Python utility.
Capability inventory: scripts/generate_report.py has the capability to write files and modify file system permissions. The skill also permits the execution of multiple Bash tool namespaces (security:*, scan:*, audit:*).
Sanitization: The generate_report.py script does not perform any sanitization, validation, or escaping of the template string before writing it into an executable .sh file.

validating-pci-dss-compliance