The Agent Skills Directory

[DATA_EXFILTRATION]: The skill facilitates the reading of local files and their transmission to a remote server (https://dropoff.sh). It uses node:fs.readFileSync to read content and fetch for uploads. This is the intended purpose of the tool, but it creates a potential surface for data exfiltration if the agent is prompted to target sensitive system files.
[INDIRECT_PROMPT_INJECTION]: The skill implements a --read feature that fetches content from external URLs and prints it to the terminal. This introduces a vulnerability to indirect prompt injection, where an agent processing the fetched content could be manipulated by instructions embedded in the remote file.
Ingestion points: dropoff.ts (via the readItem and readPublicMarkdown functions).
Boundary markers: The script separates metadata (printed to stderr in parentheses) from the source content (printed to stdout).
Capability inventory: The skill has access to Bun.spawnSync for command execution, readFileSync for file system access, and fetch for network operations.
Sanitization: The script does not sanitize or filter the remote content, printing it directly to stdout.
[COMMAND_EXECUTION]: The script uses Bun.spawnSync to execute git rev-parse --show-toplevel locally. This is used to determine the project name for automatic tagging in the repository where the command is run.
[CREDENTIALS_UNSAFE]: The skill requires a DROPOFF_TOKEN environment variable for authentication. The documentation follows security best practices by explicitly warning users not to store this token in project-level configuration files that might be committed to version control, recommending private environment files instead.

dropoff