The Agent Skills Directory

[COMMAND_EXECUTION]: The skill uses subprocess.run to call system utilities such as git, security (macOS), secret-tool (Linux), and powershell (Windows). These calls are performed using list-based arguments to prevent shell injection, and they are strictly necessary for the skill's defined functionality of secret management and repository auditing.\n- [DATA_EXFILTRATION]: While the skill manages highly sensitive TOTP seeds and recovery codes, it includes robust measures to prevent accidental exposure. It mandates that secrets be passed via standard input (stdin) to avoid command history logs and provides a describe function to inspect secret metadata without revealing the secret value itself.\n- [CREDENTIALS_SAFE]: The skill implements a hierarchical storage strategy that prioritizes encrypted OS keychains (macOS Keychain, libsecret, Windows SecretStore). For file-based fallbacks, it uses atomic writes and restricts access with mode 600 for files and 700 for directories, ensuring that stored credentials remain private to the user.\n- [INDIRECT_PROMPT_INJECTION]: The scan_leaks.py script presents a potential attack surface as it processes untrusted file contents from a repository. \n
Ingestion points: Reads text from all non-binary files within the repository root during scanning (scripts/scan_leaks.py).\n
Boundary markers: None; the script scans the raw content of tracked and untrusted files.\n
Capability inventory: Uses subprocess.run for git operations (scripts/scan_leaks.py) and various secret store utilities (scripts/secret_store.py).\n
Sanitization: The script performs static regular expression matching on individual lines and limits the processed line length to 4000 characters, preventing the interpretation of malicious content found in scanned files.

totp-secret-store