The Agent Skills Directory

[CREDENTIALS_UNSAFE]: Hardcoded credential patterns detected in tests/flawed-plugin/scripts/bad_script.py. The file contains an assembled credential string and hardcoded authorization token placeholders.
[DATA_EXFILTRATION]: Access to sensitive environment variables. The script tests/flawed-plugin/scripts/bad_script.py attempts to read DATABASE_PASSWORD from the system environment, which could be used to harvest database credentials.
[EXTERNAL_DOWNLOADS]: Unauthorized network operations to non-whitelisted domains. The script tests/flawed-plugin/scripts/bad_script.py uses the requests library to communicate with https://example.invalid/api, and tests/flawed-plugin/scripts/danger.sh uses curl to access https://example.com/data.
[COMMAND_EXECUTION]: Use of dangerous subprocess calls for shell execution. The file tests/flawed-plugin/scripts/bad_script.py uses subprocess.run to execute commands, creating a potential vector for command injection.
[PROMPT_INJECTION]: Vulnerability to indirect prompt injection (Category 8). The skill ingests external data (plugin files) for analysis. It lacks explicit boundary markers or sanitization for this untrusted content, and the agent has access to capabilities like Bash, Read, and Write (specified in SKILL.md and l5-red-team-auditor.md), which could be abused if malicious instructions are found in processed files.

audit-plugin-l5