Misc small security fixes, mostly using more secure RNGs and adding timeouts to requests in scripts

Author: kaleko

scripts/post-deploy.py

@@ -35,7 +35,7 @@ def generate_aws_exports(stack_name):
             "--output", "json"
         ]
 
-        result = subprocess.run(
+        result = subprocess.run(  # nosec B603 - command constructed from safe list, not user input
             command, 
             capture_output=True, 
             text=True, 

scripts/test-agent-invocation.py

@@ -20,7 +20,7 @@
 import socket
 import argparse
 import getpass
-import subprocess
+import subprocess  # nosec B404 - subprocess used securely with explicit parameters
 import signal
 import atexit
 from pathlib import Path
@@ -105,7 +105,7 @@ def start_local_agent(memory_id: str, region: str) -> subprocess.Popen:
 
     # Start agent process
     try:
-        _agent_process = subprocess.Popen(
+        _agent_process = subprocess.Popen(  # nosec B607 - command constructed from validated path, shell=False
             ["uv", "run", str(agent_path)],
             env=env,
             stdout=subprocess.PIPE,