The Agent Skills Directory

[CREDENTIALS_UNSAFE]: The skill documents the command algobot profiles show <name>, which prints API keys in plaintext to the terminal. While the documentation includes a warning to avoid using this in shared environments, an autonomous agent could be instructed to execute this command and exfiltrate the returned secrets.
[EXTERNAL_DOWNLOADS]: The skill requires the installation of the algobot-ai package via npm (npm install -g algobot-ai). This package is a verified resource from the vendor, Algolia, and is used for its intended purpose of managing AI agents.
[INDIRECT_PROMPT_INJECTION]: The skill supports a 'Config-as-Code' workflow using mustache templates ({{key}}) to dynamically generate agent configurations and instructions.
Ingestion points: Template variables provided via the --var flag at runtime in commands like algobot agents create --config agent-config.json --var key=value (detected in references/config-as-code.md).
Boundary markers: The skill does not mention explicit boundary markers or delimiters to separate template variables from the rest of the prompt instructions.
Capability inventory: The skill allows creating, updating, and chatting with agents that have access to search tools and external API integrations via MCP (detected in SKILL.md and references/commands.md).
Sanitization: Mustache templates perform JSON-safe escaping for fields within JSON configuration files, but use raw substitution for instructions in .md files, which increases the risk of prompt injection if variable values are untrusted.

algobot-cli