The Agent Skills Directory

[REMOTE_CODE_EXECUTION]: The skill executes code downloaded from the npm registry at runtime via 'npx atxp@latest'. While this is an intended feature of the vendor's CLI, it establishes a dependency on the 'atxp' package (https://www.npmjs.com/package/atxp) and the npm registry's security.
[INDIRECT_PROMPT_INJECTION]: The skill has a large attack surface for indirect prompt injection due to ingestion points in 'SKILL.md' such as web search ('atxp search'), X/Twitter ('atxp x'), and incoming communication ('atxp email read', 'atxp phone read-sms'). The skill provides specific boundary markers (e.g., [BEGIN UNTRUSTED CONTENT]) and instructions to treat external data as reference-only to mitigate this risk.
[CREDENTIALS_UNSAFE]: The skill handles a sensitive 'ATXP_CONNECTION' token, which is stored in plain text within '~/.atxp/config'. This credential grants access to the agent's identity and wallet. The skill instructions emphasize protecting this token from being logged or sent over communication channels.
[DATA_EXFILTRATION]: The 'email send' and 'phone send-sms' commands provide capabilities to transmit data to external recipients. When combined with the ingestion of untrusted data, this creates a potential exfiltration path if the agent is successfully injected. The skill author has included explicit guardrails against relaying credentials or untrusted content.
[COMMAND_EXECUTION]: The skill uses subprocess calls to execute the 'atxp' CLI. This involves passing arguments that might be sourced from external, untrusted data, requiring strict sanitization to prevent command injection at the tool level.

atxp