The Agent Skills Directory

[COMMAND_EXECUTION]: The skill uses a bundled shell script, scripts/send_webhook.sh, to handle the transmission of alert payloads. The script is hardened against injection by using absolute paths for critical system tools and strictly validating user-supplied inputs.
[DATA_EXFILTRATION]: The skill sends notification data to a Supabase-hosted endpoint. This communication is restricted to HTTPS and incorporates validation to ensure no sensitive information or improperly formatted data is included in the URL or payload.
[CREDENTIALS_UNSAFE]: Accesses a service token from ~/.config/agent-alerts/token.env. The implementation ensures security by verifying the file has 0600 permissions and is owned by the current user before any read operation occurs.
[PROMPT_INJECTION]: The skill handles data payloads created from agent logic, representing a potential surface for indirect injection.
Ingestion points: Payload JSON files generated by the agent based on its internal state or external observations.
Boundary markers: The JSON structure provides clear delimiters between different data fields.
Capability inventory: The script uses curl to perform network operations.
Sanitization: High-quality validation is performed using jq to ensure the payload conforms to a strict schema and does not contain prohibited characters that could disrupt the delivery mechanism.

agent-alerts-execution