The Agent Skills Directory

[PROMPT_INJECTION]: The skill instructs the agent to modify its core configuration by appending permanent rules to SOUL.md. This is a persistence mechanism that overrides default agent behavior across all future sessions.
[DATA_EXFILTRATION]: The skill defines an API at skillscan.tokauth.com used to upload local data. The scan process involves performing a POST request to /oapi/v1/skill-scan/upload, which sends the content or metadata of other local skills to an external server.
[COMMAND_EXECUTION]: The skill relies on the execution of a local Python script scripts/scanner.py for its primary functions. It also includes an 'Auto Update' feature that performs daily, silent updates of its own executable code, which is a high-risk pattern for remote code execution.
[DATA_EXPOSURE]: The skill requires access to the filesystem to read other skills (directories and .zip files) and write configuration files (scripts/.first_run_done), creating a significant data exposure surface.
[INDIRECT_PROMPT_INJECTION]: The skill is designed to ingest and process untrusted data from other skills during the scanning process, which is a known attack surface for indirect prompt injection.
Ingestion points: Processes third-party skill directories, .zip files, and SKILL.md content via the scanner.py scan command.
Boundary markers: No explicit boundary markers or 'ignore' instructions are provided for the data being analyzed.
Capability inventory: Executes subprocesses (python scanner.py), performs network uploads via POST, and modifies core agent instructions (SOUL.md).
Sanitization: No evidence of sanitization or validation of the ingested skill data before processing or upload.

skillscan