Production hardening: security fixes, code quality, 724 skills complete

- Fix 25 shell=True subprocess calls with list-based commands
- Fix 49 verify=False in defensive skills (env-var override)
- Add timeout to 231 HTTP/subprocess/socket calls
- Fix 6 SQL injection patterns with whitelist validation
- Replace 8 __import__() with standard imports
- Remove 701 unused imports across 442 files
- Add authorized-testing disclaimers to all offensive skills
- Complete 11 incomplete skill directories
- Expand 10 stub SKILL.md files with full content
- Fix 2 YAML parse errors in frontmatter
- Fix 5 pre-existing syntax errors
- Convert 22 hardcoded paths/ports to environment variables
- Back up 21 redundant skill pairs to .bak
- Fix 2 global declaration errors
- 724/724 skills with full folder anatomy (SKILL.md + agent.py + api-reference.md + LICENSE)
- 0 compile errors across all 724 agent.py files

skills/detecting-network-anomalies-with-zeek/scripts/agent.py

@@ -10,8 +10,8 @@ from datetime import datetime
 from pathlib import Path
 
 
-ZEEK_BIN = "/opt/zeek/bin/zeek"
-ZEEK_LOG_DIR = "/opt/zeek/logs/current"
+ZEEK_BIN = os.environ.get("ZEEK_BIN", "/opt/zeek/bin/zeek")
+ZEEK_LOG_DIR = os.environ.get("ZEEK_LOG_DIR", "/opt/zeek/logs/current")
 
 
 def check_zeek_status():
@@ -240,7 +240,11 @@ def analyze_pcap(pcap_path):
     if not os.path.exists(pcap_path):
         return {"error": f"PCAP not found: {pcap_path}"}
 
-    output_dir = f"/tmp/zeek_analysis_{datetime.now().strftime('%Y%m%d_%H%M%S')}"
+    import tempfile
+    output_dir = os.path.join(
+        os.environ.get("ZEEK_OUTPUT_DIR", tempfile.gettempdir()),
+        f"zeek_analysis_{datetime.now().strftime('%Y%m%d_%H%M%S')}"
+    )
     os.makedirs(output_dir, exist_ok=True)
     try:
         result = subprocess.run(