The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill instructs agents to read and write files synchronized from external providers such as Notion, Slack, and GitHub. These external sources represent a risk surface where malicious content could influence the agent's behavior.\n
Ingestion points: Files located within the mount directory, for example, ~/relayfile-mount/notion/pages/content.md or ~/relayfile-mount/slack/channels/.\n
Boundary markers: The instructions do not provide specific delimiters or guidance for the agent to distinguish between its instructions and the content of the mounted files.\n
Capability inventory: The agent is granted read/write access to the mounted filesystem and is encouraged to use CLI tools for workspace management, which includes network-connected operations.\n
Sanitization: There is no mention of sanitizing or validating the content retrieved from external providers before processing.\n- [EXTERNAL_DOWNLOADS]: The skill includes instructions to fetch remote content from vendor-controlled domains.\n
Evidence: curl -sSL -H 'Accept: text/markdown' https://arelay.to/agent-relay is used to retrieve markdown instructions.\n
Evidence: Interaction with agentrelay.com and relayfile.dev for authentication and workspace management.\n- [COMMAND_EXECUTION]: The skill relies on the execution of multiple shell commands to set up the environment, manage the mount daemon, and perform writeback operations.\n
Evidence: Extensive use of the relayfile CLI tool (setup, mount, status, writeback, etc.) and standard utilities like curl, jq, and rm.\n- [CREDENTIALS_UNSAFE]: The skill identifies the specific local file paths where the Relayfile CLI stores sensitive authentication tokens.\n
Evidence: Explicit mention of ~/.relayfile/cloud-credentials.json and ~/.relayfile/credentials.json as the storage locations for access tokens.

setting-up-relayfile