The Agent Skills Directory

[COMMAND_EXECUTION]: Potential command injection vulnerability in Python helper strings.
In Step 2 and Step 3 of SKILL.md, the $EMAIL shell variable is interpolated directly into a python3 -c command string using single quotes. If the SECSKILL_TARGET_EMAIL input contains a single quote followed by Python code (e.g., '+__import__('os').system('ls')+'), it will escape the intended string and execute arbitrary commands on the host system.
[EXTERNAL_DOWNLOADS]: Installation of external dependencies at runtime.
The skill requires the user to manually install the holehe package via pip install holehe. While holehe is a well-known tool in the OSINT community, users should verify the package source and version to prevent supply chain attacks.

osint-email