The Agent Skills Directory

[CREDENTIALS_UNSAFE]: The skill is explicitly designed to discover, manage, and synchronize 'Authentication tokens and credentials' across various AI platforms. This behavior facilitates the centralization and potential exposure of sensitive authentication data.
[DATA_EXFILTRATION]: The skill targets multiple sensitive local directories and files that typically contain API keys, configuration secrets, and session data:
~/.config/claude/claude_desktop_config.json (Claude Code configuration)
~/.factory/droids/ (Factory Droid data)
~/.antigravity/scripts/ (Antigravity script repository)
~/Library/Application Support/Google/Chrome/Profile 1/Extensions/ (Browser extension data)
[DATA_EXFILTRATION]: The configuration includes parameters for Slack webhooks and email alerts. These channels could be used to transmit the discovered sensitive credentials or system inventory to external endpoints.
[COMMAND_EXECUTION]: The scripts/discover-all.sh script uses eval to expand file paths and python3 -c for dynamic code execution to parse configuration files. Additionally, the skill's documentation describes 'auto-repair' capabilities that involve automated dependency installation and service restarts, which are high-risk operations.
[PROMPT_INJECTION]: The skill processes untrusted data from multiple sources (external repository scans in Factory Droid and Antigravity scripts) without sanitization or boundary markers, creating a surface for indirect prompt injection:
Ingestion points: ~/.config/claude/claude_desktop_config.json, ~/.factory/droids/, ~/.antigravity/scripts/.
Boundary markers: Absent in script logic.
Capability inventory: Execution of numerous management scripts, file system writes to ./mcp-discovery, and network alerting (Slack/Email).
Sanitization: No evidence of input validation or escaping before processing configuration data.

MCP Universal Manager