The Agent Skills Directory

[COMMAND_EXECUTION]: The script scripts/agent.py is vulnerable to command injection in the verify_ca_deployed method. The internal_ca_cn variable is interpolated directly into a PowerShell command string without sanitization, allowing arbitrary code execution via a crafted CA name. This was also flagged by static analysis regarding the use of subprocess.run.
[COMMAND_EXECUTION]: The skill instructions in SKILL.md require high-privilege access to modify system root certificate stores across multiple operating systems (e.g., using Import-Certificate on Windows, sudo security add-trusted-cert on macOS, or update-ca-certificates on Linux). These actions represent a significant security risk if the agent is directed to install unauthorized or malicious certificates.
[INDIRECT_PROMPT_INJECTION]: The skill connects to and processes certificate metadata from external hosts, creating an attack surface for indirect prompt injection.
Ingestion points: Certificate issuer and subject fields parsed from s.getpeercert() in scripts/agent.py.
Boundary markers: None present; the script lacks delimiters or instructions to ignore embedded commands in certificate metadata.
Capability inventory: Subprocess execution (subprocess.run), network socket creation (socket), and file system interaction.
Sanitization: None; the script processes parsed certificate strings using simple string matching without escaping or validation.

performing-ssl-tls-inspection-configuration