The Agent Skills Directory

[DATA_EXFILTRATION]: The skill requires sensitive credentials, including the master password and secret values, to be passed as command-line arguments using flags like --password and --value. This practice exposes secrets to any user on the system who can view process listings and records them in plaintext within shell history files.
[COMMAND_EXECUTION]: The skill's design forces the use of high-risk command-line execution patterns where raw secrets are processed in the shell. Even when environment variables are suggested, shell expansion typically occurs before the process is created, leaving the secret values visible in the system's process table.
[DATA_EXFILTRATION]: The storage file ~/.aibtc/credentials.json stores metadata, such as credential IDs, labels, categories, and timestamps, in plaintext. This metadata exposure allows an observer to learn about the services and accounts managed by the skill even without access to the encrypted secrets.
[INDIRECT_PROMPT_INJECTION]: The skill creates a surface for indirect prompt injection by ingesting untrusted data through the CLI and storing it for later retrieval by the agent. Ingestion points: credentials.ts (via add and get subcommands). Boundary markers: No delimiters are used to separate stored data from agent instructions. Capability inventory: The skill has read and write access to the local filesystem for credential management. Sanitization: While identifiers are normalized, the actual secret values and labels are stored and retrieved without any sanitization or escaping.

credentials