The Agent Skills Directory

[CREDENTIALS_UNSAFE]: The skill instructions in SKILL.md (Step 2) direct the agent to search for and extract API keys from sensitive platform configuration files, including ~/.claude.json, ~/.gemini/settings.json, and .gemini/antigravity/mcp_config.json.
[COMMAND_EXECUTION]: The skill relies on executing a local Python script (upload_to_stitch.py) to process files and perform network requests, using the Bash and Write tools defined in the allowed-tools list.
[DATA_EXFILTRATION]: The upload_to_stitch.py script reads local file content, encodes it, and transmits it to a remote API. While the default destination (stitch.googleapis.com) is a trusted service, the script accepts an optional --api-url parameter, which could be used to redirect sensitive file data or extracted API keys to an arbitrary external endpoint.
[INDIRECT_PROMPT_INJECTION]: The skill creates an attack surface by ingesting and processing untrusted local data (HTML, Markdown) which is then transmitted to an external service.
Ingestion points: The upload_to_stitch.py script reads files from the local filesystem specified by the --file-path argument.
Boundary markers: The skill includes a 'User Confirmation Required' checkpoint in SKILL.md intended to pause execution for user approval.
Capability inventory: The skill utilizes filesystem read access and network POST capabilities via Python's urllib.request library.
Sanitization: No validation or sanitization of the file content is performed; the data is base64-encoded for transmission in its raw state.

stitch-upload-to-stitch