Expanso tls-inspect

This skill appears to do what it says (inspect TLS certs), but exercise caution before installing/using it: - Command-injection risk: The CLI pipeline embeds the provided host directly into a shell command passed to sh -c. Do not run this skill on untrusted input or in contexts where an attacker can control the host string. Prefer sanitizing/validating host names (allow only hostname[:port] patterns) or modify the pipeline to avoid invoking a shell with unescaped user data. - Mode mismatch: CLI mode performs a real openssl connection; MCP mode returns mock/dummy certificate data. Treat MCP as a testing/mock endpoint only — it will not reflect real TLS state. - Missing metadata: The SKILL.md and pipeline require expanso-edge and openssl, but the skill registry metadata does not declare these required binaries. Confirm those dependencies are present before use. - Operational controls: If you will expose this to other users or wire it into automation, ensure input validation, run it in a least-privileged environment, and audit logs/outputs. If you are not comfortable reviewing or editing the pipeline to safely escape inputs, avoid installing it or ask the author to fix the shell invocation to use a safer API (avoid sh -c or properly escape/validate host input). If the maintainer can demonstrate that the runtime escapes/validates host input or replace the sh -c invocation with a safer call (e.g., exec openssl directly without shell interpolation), the remaining concerns would be largely resolved.