korea-metropolitan-bus-alerts

Remove any persistence mechanisms. Skills should not modify system startup configurations, crontabs, LaunchAgents, systemd services, or shell profiles.

Review all shell execution calls. Ensure commands are static (not built from user input), use absolute paths, and are strictly necessary. Prefer library APIs over shell commands.

1. **Sanitize/Validate User Input**: Strictly validate `city`, `node`, and `routes` to ensure they only contain expected characters (e.g., alphanumeric, specific delimiters) before embedding them into the prompt. Implement a whitelist of allowed characters. 2. **Isolate Commands**: Instead of embedding the command directly in the LLM's prompt, consider having the LLM generate structured data (e.g., JSON) that specifies the action and its parameters. A separate, trusted component would then parse this structured data and execute the actual `python3` command with properly escaped arguments. 3. **Avoid "Run:" instructions**: Rephrase the prompt to guide the LLM's reasoning process without explicitly instructing it to "Run" a shell command. For example, "Generate the parameters for the `tago_bus_alert.py` script to get arrivals for city `{city}`, node `{node}`, and routes `{routes_csv}`. Then, summarize the results."

Avoid using dangerous functions like exec/eval/os.system. Use safer alternatives.

Verify that access to this sensitive path is justified and declared.

1. **Validate Arguments**: Implement strict validation for `--unit` and `--env-file` arguments. For `--unit`, ensure it matches expected systemd unit naming conventions (e.g., alphanumeric, hyphens, dots, no path separators). For `--env-file`, ensure it is a simple filename or a path within a controlled directory, disallowing path traversal sequences (`../`). 2. **Use `Path.resolve()`**: When constructing paths, use `Path.resolve()` to get the absolute, normalized path, which can help detect and prevent path traversal attempts. 3. **Sanitize for `systemctl`**: Ensure that any user-provided unit names passed to `systemctl` commands are properly sanitized or validated against a whitelist of allowed unit names to prevent arbitrary service manipulation.

Remove obfuscated code execution patterns. Legitimate code does not need base64-encoded payloads executed via eval, encrypted-then-executed blobs, or dynamic attribute resolution to call system functions.

Verify this import is necessary. Network and system modules in skill code may indicate data exfiltration.

1. **Validate Input**: If the script is to be invoked by an LLM or with user-controlled arguments, validate `$1` to ensure it is a safe path (e.g., no path traversal characters, only alphanumeric and allowed path separators). 2. **Use safer alternatives**: For file operations, prefer Python scripts with `pathlib` and `subprocess.run` with `shell=False` and a list of arguments, as demonstrated in `setup.py`, which is generally more robust against shell injection than direct shell script execution with unsanitized variables.