The Agent Skills Directory

[EXTERNAL_DOWNLOADS]: Detected confirmed malicious URL cs2floatchecker.com referenced in docs/cs2-anatomy/gloves.md. This domain is blacklisted for malicious activity. Additionally, the files docs/cs2-anatomy/rifles.md and docs/cs2-anatomy/gloves.md were confirmed as malware by reputation scanners.
[EXTERNAL_DOWNLOADS]: The script forge/stage1_intake/fetch_cs2_metadata.py performs unvalidated network requests via urllib.request.urlopen and downloads remote files using urlretrieve. These requests are based on user-provided or remotely-fetched URLs without any validation, creating a significant risk for Server-Side Request Forgery (SSRF) and arbitrary file downloads.
[COMMAND_EXECUTION]: Multiple Python scripts throughout the forge/ directory use subprocess.run to call system commands and Node.js scripts (e.g., in extract_pbr_evidence.py, make_comparison_sheet.py, and render_bridge.py). This practice provides a broad surface for arbitrary command execution on the host system.
[PRIVILEGE_ESCALATION]: The SKILL.md file provides installation and execution instructions that encourage users to bypass system security controls by running PowerShell with the -ExecutionPolicy Bypass flag.
[DYNAMIC_EXECUTION]: Static analysis identified the use of __import__() for dynamic module loading and sys.path manipulations across several files, such as forge/stage4_review/compare_region_passes.py and forge/stage4_review/diagnose_render.py. These patterns can be used to hide the execution of malicious logic from static analysis tools.
[DATA_EXFILTRATION]: The combination of file-reading capabilities and arbitrary network requests in fetch_cs2_metadata.py (which explicitly bypasses security lints with a # noqa: S310 comment) presents a high risk of sensitive local data being exfiltrated to attacker-controlled servers.

img2threejs