The Agent Skills Directory

[COMMAND_EXECUTION]: The Ruby helper script scripts/brakeman_helper.rb constructs shell commands by interpolating variables such as the application path (e.g., @options[:app_path]) and other configuration strings into a single command string (e.g., cmd = ['brakeman', '-p', @options[:app_path], ...].join(' ')), which is then executed via system(). This allows arbitrary command execution if these inputs contain shell metacharacters.
[DYNAMIC_EXECUTION]: The helper script included in the skill dynamically generates and runs system commands at runtime based on user-specified parameters and workflow selections.
[INDIRECT_PROMPT_INJECTION]: The skill is designed to ingest and scan Ruby on Rails source code. This creates an attack surface where maliciously crafted source files could contain instructions designed to influence or mislead the agent when it subsequently processes the generated security reports.
[EXTERNAL_DOWNLOADS]: The documentation provides instructions to install the Brakeman scanner via RubyGems and Docker Hub, which are the official and well-known distribution platforms for this security tool.

brakeman