The Agent Skills Directory

[COMMAND_EXECUTION]: The skill uses the subprocess module to run the Bandit security linter and pip. These calls use list-based arguments and omit the shell=True parameter, which is a recommended security practice to prevent shell injection attacks.
[EXTERNAL_DOWNLOADS]: The script automatically installs the bandit package from PyPI if it is not already present in the environment. This is a legitimate functional requirement for a linting tool to ensure the necessary dependencies are available at runtime.
[PROMPT_INJECTION]: While the README.md file contains a code snippet showing exec(user_input), this content is located within an example output block to demonstrate the type of vulnerabilities the tool detects. It is not an instruction for the agent to execute unsafe code and does not represent an injection attempt.

security-linting