Production hardening: security fixes, code quality, 724 skills complete

- Fix 25 shell=True subprocess calls with list-based commands
- Fix 49 verify=False in defensive skills (env-var override)
- Add timeout to 231 HTTP/subprocess/socket calls
- Fix 6 SQL injection patterns with whitelist validation
- Replace 8 __import__() with standard imports
- Remove 701 unused imports across 442 files
- Add authorized-testing disclaimers to all offensive skills
- Complete 11 incomplete skill directories
- Expand 10 stub SKILL.md files with full content
- Fix 2 YAML parse errors in frontmatter
- Fix 5 pre-existing syntax errors
- Convert 22 hardcoded paths/ports to environment variables
- Back up 21 redundant skill pairs to .bak
- Fix 2 global declaration errors
- 724/724 skills with full folder anatomy (SKILL.md + agent.py + api-reference.md + LICENSE)
- 0 compile errors across all 724 agent.py files

skills/implementing-honeytokens-for-breach-detection/scripts/agent.py

@@ -8,8 +8,12 @@ import hashlib
 import argparse
 from datetime import datetime
 
+import re
+
 import requests
 
+_SAFE_TABLE_RE = re.compile(r'^[a-zA-Z_][a-zA-Z0-9_]*$')
+
 
 def create_dns_canarytoken(email, memo, webhook_url=None):
     """Create a DNS canary token via Canarytokens.org API."""
@@ -79,6 +83,8 @@ def deploy_aws_credential_token(target_path, canary_key_id, canary_secret):
 
 def deploy_database_honeytoken(db_connection_string, table_name="users"):
     """Generate SQL to insert honeytoken records into a database."""
+    if not _SAFE_TABLE_RE.match(table_name):
+        raise ValueError(f"Invalid table name: {table_name!r}")
     token_id = generate_honeytoken_id()
     fake_users = [
         {
@@ -97,11 +103,13 @@ def deploy_database_honeytoken(db_connection_string, table_name="users"):
     sql_statements = []
     for user in fake_users:
         sql = (
-            f"INSERT INTO {table_name} (username, email, role, api_key) "
-            f"VALUES ('{user['username']}', '{user['email']}', "
-            f"'{user['role']}', '{user['api_key']}');"
+            f"INSERT INTO [{table_name}] (username, email, role, api_key) "
+            "VALUES (?, ?, ?, ?);"
         )
-        sql_statements.append(sql)
+        sql_statements.append({
+            "query": sql,
+            "params": [user["username"], user["email"], user["role"], user["api_key"]],
+        })
     return {"token_id": token_id, "sql_statements": sql_statements, "records": fake_users}