fix(security): remediate findings from security assessment#33

Open

rpolysec wants to merge 10 commits into

mainfrom

fix/security-assessment-pen-2026-005

Commits on May 6, 2026

fix(security): resolve critical command injection and pickle RCE
rpolysec
committed
fix(security): harden LLM trust boundary — restrict skill generator tools and validate skill names
rpolysec
committed
fix(security): prevent shell and YAML injection in remote/docker backends
rpolysec
committed
fix(security): harden Dockerfile — non-root user, pin Node.js and Goose
rpolysec
committed
fix(security): dependency pins, API key warning, process kill scope, safe YAML
rpolysec
committed
docs(security): add security considerations and fix script scorer example
rpolysec
committed
test: update tests for security fixes
rpolysec
committed
fix: pin Goose to v1.33.1 (correct current release)
rpolysec
committed
fix: add libgomp1 for Goose binary (missing after build-essential removal)
rpolysec
committed
fix: add ~/.local/bin to PATH for non-root user pip installs
rpolysec
committed