The Agent Skills Directory

[CREDENTIALS_UNSAFE]: The skill instructions require the agent to execute cat ~/.bitwize-music/config.yaml to verify configuration. This file contains sensitive credentials including access_key_id and secret_access_key for Cloudflare R2 and AWS S3. Reading this file into the agent's context exposes raw secrets in the conversation history.
[EXTERNAL_DOWNLOADS]: The skill documentation specifies the installation of the boto3 Python package, which is the official AWS SDK and a well-known service dependency for interacting with S3-compatible APIs.
[INDIRECT_PROMPT_INJECTION]: The skill processes external data which serves as a potential attack surface.
Ingestion points: Reads configuration from ~/.bitwize-music/config.yaml and scans media files in {audio_root}/artists/{artist}/albums/{genre}/{album}/ using Glob and ls.
Boundary markers: None identified for the configuration file content or file system paths.
Capability inventory: The skill uses Bash to execute Python upload scripts and Read to inspect local configuration files.
Sanitization: No explicit sanitization or validation of the config values or file names is mentioned before they are passed to the upload script command-line arguments.

cloud-uploader