Expanso tls-inspect

meta host = content().trim() ... name: "sh" ... args: ["-c", "echo | openssl s_client -servername \"${! this.host }\" -connect \"${! this.host_with_port }\""]

The pipeline takes the host directly from input and inserts it into a shell command. Without hostname validation or shell-safe escaping, crafted host text could be interpreted as shell syntax instead of only as an OpenSSL argument.

"issuer": "Demo CA" ... root.valid = true ... root.days_until_expiry = 365

The MCP pipeline does not connect to the requested host or inspect a real certificate; it fabricates successful certificate details for the supplied host.

# Check if expired (simple string comparison won't work for dates, so mark as valid if we got data)
let has_cert = $subject != "Unknown"

The CLI pipeline's valid result is based on whether any certificate subject was found, not whether the certificate is unexpired, chain-valid, or cipher-checked as the skill description claims.

expanso-cli job deploy https://skills.expanso.io/tls-inspect/pipeline-cli.yaml

The deployment example fetches a remote pipeline by URL rather than deploying the reviewed local file with a pinned hash or version.

http:
  enabled: true
  address: "0.0.0.0:${PORT:-8080}"
...
http_server:
  path: /inspect
  allowed_verbs: [POST]

When MCP mode is started, it listens on all network interfaces rather than only localhost.