The Agent Skills Directory

[CREDENTIALS_UNSAFE]: The skill explicitly instructs the agent to harvest sensitive credentials from the user's personal files. In SKILL.md under Phase 1 (Agent 2), it directs the agent to search Obsidian vaults and 'Extract: credentials (EFTPS, accountant portal)'.
[COMMAND_EXECUTION]: The skill uses shell commands to interact with the host system. In Phase 3, it provides a command line for Google Chrome: '"/Applications/Google Chrome.app/Contents/MacOS/Google Chrome" --headless --disable-gpu --print-to-pdf="output.pdf" input.html'. It also suggests using 'pandoc' or 'wkhtmltopdf' as fallbacks. In Phase 7, it instructs the agent to 'Git commit and push all changes', which involves multiple shell-level operations.
[DATA_EXFILTRATION]: The skill establishes a pipeline for exfiltrating sensitive tax and credential data. Phase 7 instructs the agent to 'push all changes' to a Git repository and 'Update Claude memory with payment record', effectively sending sensitive financial confirmations to external services.
[INDIRECT_PROMPT_INJECTION]: The skill possesses a large attack surface for indirect injection.
Ingestion points: It reads data from Xero APIs, Gmail (accountant correspondence, invoices), bank statement PDFs, Obsidian vaults, and Google Drive files (SKILL.md Phase 1).
Boundary markers: No boundary markers or instructions to ignore embedded commands in these external sources are present.
Capability inventory: The skill can write files, execute shell commands (Chrome, Git, Pandoc), and perform network operations via Git and API calls.
Sanitization: There is no evidence of sanitization or validation of the content retrieved from external files or emails before it is processed or used to generate tax documents.

tax-filing