securityreview

Remove the private key block from the skill definition. Store private keys in a secrets manager or encrypted volume and reference them via environment variables.

Likely FP if the match is a documentation example showing the format of a PEM block without a real key body.

Isolate security-sensitive operations from untrusted data flows. Use separate execution contexts or privilege levels for operations that handle both user input and sensitive resources.

Likely FP if the toxic flow analysis connected two unrelated code paths, or if the data undergoes transformation that removes the taint (e.g., parsed as a known enum value).

Remove the AWS access key from the skill definition and use environment variables or IAM roles instead. Rotate the exposed key immediately via the AWS console.

Likely FP if the matched string is a placeholder (e.g., AKIAEXAMPLE), a documentation example, or a test fixture key that is not valid.

Pass arguments as an explicit list instead of a shell string. Set shell=False and validate all user-supplied values before inclusion.

Likely FP if the match is in documentation explaining Python subprocess usage or in a description mentioning it as a topic.