The Agent Skills Directory

[COMMAND_EXECUTION]: The script scripts/generate_report.py contains a generate_script method that dynamically assembles a bash script from a user-provided template string and saves it to a file.
Evidence: Line 72 in scripts/generate_report.py defines generate_script(self, name: str, template: str). This method is accessible via the CLI using the --type script argument combined with --content.
[COMMAND_EXECUTION]: The generate_script method in scripts/generate_report.py explicitly grants execution permissions to the newly created script.
Evidence: Line 90 in scripts/generate_report.py executes file_path.chmod(0o755), which marks the generated file as executable by any user.
[COMMAND_EXECUTION]: Risk of Indirect Prompt Injection during codebase scanning.
Ingestion points: The skill instructions in SKILL.md (Step 3) direct the agent to scan the codebase for security evidence.
Boundary markers: No explicit delimiters or instructions to ignore embedded commands are provided for the data being scanned.
Capability inventory: The skill includes scripts/generate_report.py which can generate and chmod +x scripts. The SKILL.md also allows Bash access with specific prefixes.
Sanitization: There is no evidence of sanitization or validation in scripts/generate_report.py when handling the content argument, which could contain data retrieved from the scanned codebase.

generating-compliance-reports