The Agent Skills Directory

[COMMAND_EXECUTION]: The scripts scripts/secret_store.py and scripts/scan_leaks.py utilize subprocess.run to execute system commands. secret_store.py interacts with system-level secret managers via CLI tools including security, secret-tool, and powershell, while scan_leaks.py executes git for repository status checks. These operations are essential to the skill's functionality, are performed locally, and employ safe practices such as passing arguments as lists and using environment variables for sensitive parameters to prevent command injection.
[INDIRECT_PROMPT_INJECTION]: The repository scanner scripts/scan_leaks.py presents an ingestion surface for untrusted data, as it reads file contents within the workspace to identify potential shared secrets.
Ingestion points: scripts/scan_leaks.py reads files using Path.read_text() in its scan_file function.
Boundary markers: The script does not use explicit delimiters or specific instructions to isolate external content from the agent's context in the scan results.
Capability inventory: The skill has the capability to read/write secrets to the OS keychain and execute shell commands via git and other system utilities.
Sanitization: File content is processed via regular expressions to identify leaks but is not escaped or sanitized before being included in the findings returned to the agent. This finding is considered safe as it is the expected behavior for a security scanning utility.

totp-secret-store