{"id":79585,"plugin_id":"plugins_6ab427b8c6908191a438adb4b6f315d4","kind":"skill","collection_source":"plugin_package","comparison_source":null,"observed_at":"2026-11-04T00:11:26.485Z","digest":"39045819568819381fc6a94d5cf7912ab13cf4d50af460ca15328daf7fc5560c","against":null,"payload":{"description":"Audit Unix commands and shell scripts for injection, secret leakage, privilege abuse, destructive scope and unsafe downloads.","included_files":[],"name":"shell-security-audit","skill_md_contents":"---\nname: shell-security-audit\ndescription: Audit Unix commands and shell scripts for injection, secret leakage, privilege abuse, destructive scope and unsafe downloads.\n---\n\n# Security review for shell workflows\n\n## Scope and execution truth\nThis is a skills-only assistant workflow. Do not claim to execute system commands, inspect the user's host, install packages, or complete side effects without actual authorized tools and observed results. User-pasted output is evidence, not a machine connection.\n\n## Procedure\n1. Define trust boundaries and identify untrusted strings, user-controlled filenames, environment, remote data and privilege changes.\n2. Search for `eval`, unquoted expansions, `sh -c` with interpolation, shell command construction, unsafe temp files and blind installer patterns.\n3. Review secrets in command arguments, history, trace output, environment dumps and logs; never repeat credentials in generated examples.\n4. Examine recursive deletion, file ownership, network fetch-and-execute and remote authorization. Prefer preview, provenance verification and least privilege.\n5. Present findings by severity and exact consequence, with a minimal corrective pattern and validation.\n6. Static heuristics are triage only: ShellCheck and the bundled offline reviewer cannot certify security or production safety.\n\n## Relevant references\n- Read `../../references/security-and-secrets.md` for domain-specific guidance.\n- Read `../../references/safety-risk-model.md` for domain-specific guidance.\n- Read `../../references/shell-debugging.md` for domain-specific guidance.\n\n## Completion checks\n- Trust boundaries identified\n- No secret disclosure\n- Findings supported by code and scenario\n\n## Deliverable\nUse the minimum format that makes the answer actionable: the actual command or patch, platform assumptions, a preview before risky changes, and a reproducible validation step. Clearly label proposed actions versus observed execution.\n"},"changes":[],"summary":"First saved snapshot. No earlier version is available for comparison.","summary_kind":"deterministic","summary_metadata":{}}