The Agent Skills Directory

Sandboxed Document Assessment: The skill implements a defensive document assessment mechanism in helpers/document_assess.py and helpers/_document_limits.py. It utilizes worker processes with restricted environments, OS-level resource limits (Windows Job Objects or Linux rlimits), and Python audit hooks to block unauthorized network activity, file writes, and process spawning during parsing.- Automated Secret Redaction: Robust credential protection is integrated into the core logic. Scripts such as helpers/_common.py and helpers/cu_ingestion_auth.py systematically identify and redact sensitive fields, including API keys, tokens, and connection strings, from all execution outputs and internal audit logs.- Secure Subprocess Management: Interaction with external systems is limited to the Azure CLI (az). All subprocess calls are executed with shell=False and use carefully validated argument lists to prevent shell injection vulnerabilities. The skill also verifies the integrity of the CLI environment before execution.- Defensive Data Parsing: XML and document parsing are performed using security-hardened libraries such as defusedxml to mitigate risks like XML External Entity (XXE) attacks. Strict constraints on processing depth and node counts are enforced to prevent resource exhaustion attacks.- Encapsulated Local Storage: The skill manages sensitive evidence and artifacts within operator-controlled private directories. It employs OS-specific permission enforcement (POSIX 0700/0600 and Windows DACLs) to ensure data-at-rest remains private and is protected from unauthorized access or tampering.

foundry-iq