The Agent Skills Directory

[REMOTE_CODE_EXECUTION]: The skill provides a skill add command that facilitates the installation of external AI agent skills from arbitrary source URLs or local paths. This is implemented by spawning an external npx skills add command, allowing for the execution of unverified remote code.
File: src/core/workspace-skills.ts
Evidence: spawnSync(getNpxCommand(), ["-y", "skills", "add", source, ...]) where source can be a user-provided URL.
[COMMAND_EXECUTION]: The package makes frequent use of child_process.spawn and spawnSync to interact with the host system. It executes git for journaling, npx for skill management, and utilizes platform-specific file openers like rundll32.exe on Windows, which can be high-risk if target paths are manipulated.
Files: src/utils/process.ts, src/daemon/git-journal.ts, src/core/workspace-skills.ts
[DATA_EXFILTRATION]: Functional requirements involve sending local knowledge pages and raw vault documents to external LLM providers (OpenAI, OpenRouter, vLLM) and document parsing services (TianGong Unstructure). It also communicates with Synology NAS devices over the network to sync files.
Files: src/core/embedding.ts, src/core/synology.ts, src/core/vault-processing.ts
[INDIRECT_PROMPT_INJECTION]: The skill features an automated 'vault-to-wiki' workflow that ingests and processes untrusted files from a user-defined directory. These files are read by an LLM-driven agent, making the system vulnerable to adversarial content within those files that could hijack the agent's logic.
Files: src/core/vault-processing.ts, references/vault-to-wiki-instruction.md
[CREDENTIALS_UNSAFE]: Sensitive configuration data, including LLM API keys and Synology NAS credentials (username/password), are stored in plain text within a .wiki.env file in the project workspace. Although diagnostic commands attempt to redact these keys in their output, the local storage remains a security concern.
Files: src/core/paths.ts, src/core/synology.ts (handling SYNOLOGY_PASSWORD)

tiangong-wiki-skill