The Agent Skills Directory

[EXTERNAL_DOWNLOADS]: The skill interacts with an external, third-party service at objects.yshubham.com for storing and retrieving build artifacts. This domain is not associated with the skill's author or established trusted services.
[DATA_EXFILTRATION]: The core purpose of the skill is to upload local files to a public endpoint. Although the documentation explicitly warns against uploading credentials, tokens, or private source code, the capability itself creates a risk for data exfiltration if the agent is directed to upload sensitive local files.
[COMMAND_EXECUTION]: The skill utilizes the curl utility to perform network operations, including binary data uploads (--data-binary) and file downloads (--remote-name).
[INDIRECT_PROMPT_INJECTION]: The skill possesses a vulnerability surface related to the processing of local files for upload.
Ingestion points: Local artifacts and files read by the agent from the filesystem for upload to the remote service (referenced in SKILL.md).
Boundary markers: The skill includes explicit warnings under the 'Keep uploads safe' section in SKILL.md to prevent the upload of sensitive data.
Capability inventory: The skill uses curl for HTTP POST, GET, and DELETE operations, and requires read access to the local filesystem.
Sanitization: Instructions specify a 10 MiB file size limit and require selecting an appropriate content type.

objects-storage