The Agent Skills Directory

[COMMAND_EXECUTION]: The scripts/agent.py script interacts with the HashiCorp Boundary infrastructure by executing CLI commands via the Python subprocess module.
Evidence: The script uses subprocess.run() to invoke the boundary binary for listing scopes, targets, sessions, and authentication methods.
Mitigation: Commands are constructed as lists of arguments and executed without a shell (shell=False default), which prevents shell injection vulnerabilities.
[EXTERNAL_DOWNLOADS]: The documentation provides instructions to install required software from official sources.
Evidence: SKILL.md contains commands to download the HashiCorp GPG key from https://apt.releases.hashicorp.com/gpg and add the official repository.
Context: These references target a well-known technology vendor (HashiCorp) and are considered safe practice for software installation.
[CREDENTIALS_UNSAFE]: The skill contains hardcoded cryptographic keys and credential strings used as placeholders or examples.
Evidence: SKILL.md contains example KMS keys (e.g., key = "sP1fnF5Xz85RrXM...") for Boundary's encryption configuration.
Context: These keys are clearly identified as examples and are truncated in the text. The documentation explicitly recommends using HashiCorp Vault for production key management.

implementing-zero-trust-with-hashicorp-boundary