The Agent Skills Directory

[COMMAND_EXECUTION]: The skill uses the Bash tool to execute various project-specific npm scripts (e.g., npm install, npm run collect, npm run export). These commands are standard for managing a Node.js repository and are used within the scope of operating the 'Agent Pulse' system.
[DATA_EXFILTRATION]: The skill instructions provide explicit warnings against committing .env files or credentials. It also requires the user to verify that public static exports do not contain tokens, database files, or private payloads, effectively mitigating accidental data exposure.
[REMOTE_CODE_EXECUTION]: The skill mentions npm install, which downloads dependencies for the target project. While this is a standard development workflow, the skill instructions include verification steps like npm run check to validate the environment and code before deployment.
[PROMPT_INJECTION]: Indirect prompt injection surface exists as the skill is designed to ingest and normalize external signals (RSS, web content) via the WebFetch tool. However, the skill includes mitigation strategies such as keeping facts separate from LLM-generated interpretations and enforcing deterministic readiness gates before publication.
Ingestion points: Data enters the system via src/collectors/ and the npm run collect command.
Boundary markers: The skill instructs to label uncertainty and requires traceable evidence for all claims.
Capability inventory: The agent has access to Bash, Write, Edit, and WebFetch tools.
Sanitization: Instructions specify rejecting loopback, link-local, and private URLs to prevent SSRF and other acquisition-level attacks.

agent-pulse