The Agent Skills Directory

[COMMAND_EXECUTION]: The skill uses python3 -c to execute a script block where the shell variable $COMBINED is interpolated directly into a single-quoted Python string. A user-provided value in the SECSKILL_OUTPUT_DIR or SECSKILL_SCAN_PATH environment variables containing single quotes can escape the Python string literal to execute arbitrary Python code.
[DYNAMIC_EXECUTION]: The classification step (Step 4) generates and executes Python code at runtime using shell variable interpolation, which is the primary vector for the command injection vulnerability.
[EXTERNAL_DOWNLOADS]: The prerequisites section provides instructions to download security tools (trufflehog and gitleaks) from their official GitHub repositories. These downloads target well-known services like GitHub and the GitHub API.
[PRIVILEGE_ESCALATION]: The instructions for installing gitleaks involve moving the downloaded binary to /usr/local/bin, a system directory that typically requires administrative (root) privileges.

secret-scan