The Agent Skills Directory

[CREDENTIALS_UNSAFE]: The script scripts/fetch_thread.py contains logic to explicitly search for and read the ~/.git-credentials file on the local file system to harvest plain-text GitHub authentication tokens.\n- [DATA_EXFILTRATION]: The fetch_thread_url function in scripts/fetch_thread.py utilizes urllib.request.urlopen to fetch content from arbitrary URLs without validating the protocol scheme. This permits an attacker or malicious search result to trigger the reading of sensitive local system files (e.g., /etc/passwd) via the file:// protocol. Content retrieved this way is subsequently passed to external LLM APIs (such as the Grok completions endpoint) for analysis in scripts/chain_tracker.py and scripts/relevance_gate.py, facilitating data exfiltration.\n- [INDIRECT_PROMPT_INJECTION]: The skill performs recursive fetching and synthesis of web content through scripts/chain_tracker.py. This ingested untrusted content is interpolated directly into prompts sent to LLMs in scripts/relevance_gate.py without sufficient boundary markers, semantic filtering, or sanitization, making the agent vulnerable to indirect prompt injection where a malicious website could take control of the agent's reasoning loop.\n- [DYNAMIC_EXECUTION]: The skill employs importlib.util in scripts/search.py to dynamically load and execute the fetch_thread.py module from a computed path. Furthermore, references/research-light-regression-samples.md includes a bash-embedded Python script that demonstrates dynamic execution of local modules using similar techniques.\n- [COMMAND_EXECUTION]: The instructions in SKILL.md prompt the agent to execute shell commands with arguments influenced by user queries, which represents a potential command injection vector if the execution environment does not correctly sanitize the input string before shell interpolation.

search-layer