The Agent Skills Directory

[COMMAND_EXECUTION]: The skill reads a command path (python_cmd) from shasta.config.json and uses it to execute shell commands. This pattern creates a dependency on the security of the local configuration file.
[DYNAMIC_EXECUTION]: The skill generates and executes multi-line Python script blocks using the shell's command-line interface (python -c). This is used to initialize the database, retrieve scan data, and generate report files.
[INDIRECT_PROMPT_INJECTION]: The skill processes compliance scan findings from external sources (AWS and local databases), which could theoretically contain malicious instructions.
Ingestion points: Scan findings retrieved via db.get_recent_scan() and run_full_scan(client).
Boundary markers: No specific boundary markers or instructions are present to prevent the agent from interpreting instructions embedded within the scan findings.
Capability inventory: Shell command execution via the configured Python command.
Sanitization: There is no evidence of sanitization or escaping of scan findings before they are rendered into Markdown, HTML, or PDF reports.

report