The Agent Skills Directory

[COMMAND_EXECUTION]: The workflow is vulnerable to multiple forms of command injection due to unsafe handling of user-provided filesystem paths.
Evidence: In Step 2, the shell variable ${SAFE_NAME} is used in a redirection without sufficient quoting: > "$OUTDIR/secrets_combined_${SAFE_NAME}.json". If the path contains shell metacharacters (e.g., ; command ;), they will be executed by the shell.
Evidence: In Step 4, variables derived from the path (like $COMBINED) are interpolated into a Python script executed via python3 -c. This allows for Python code injection if the path contains single quotes and Python syntax.
[EXTERNAL_DOWNLOADS]: The skill fetches tools and version information from external repositories and APIs.
Evidence: It retrieves gitleaks version data from api.github.com and downloads binary release archives from github.com.
Evidence: It also recommends using go install to fetch trufflehog from its official GitHub repository.
[PROMPT_INJECTION]: The skill processes untrusted data (file paths and file contents) while possessing high-privilege capabilities, creating an indirect injection surface.
Ingestion points: System environment variables (SECSKILL_SCAN_PATH) and the raw output of the secret scanning tools.
Boundary markers: There are no protective markers or instructions used to prevent the agent from interpreting data as commands.
Capability inventory: The skill can execute arbitrary shell commands, access the filesystem, and perform network requests.
Sanitization: No escaping or validation is performed on inputs before they are used in sensitive shell or Python contexts.

secret-scan