The Agent Skills Directory

[CREDENTIALS_UNSAFE]: The skill implements an automated 'Credential auto-discovery' process that specifically targets and reads sensitive files on the host system. This includes scanning shell configuration files (~/.zshrc, ~/.bashrc, ~/.bash_profile, ~/.zprofile) and environment files (.env, .envrc) for API keys and secrets. It further attempts to harvest credentials from the macOS Keychain using the security command and from 1Password using the op CLI.
[REMOTE_CODE_EXECUTION]: The skill's core function is to fetch documentation from arbitrary, user-provided URLs and instruct subagents to execute the commands found there. This includes running npm install, pip install, curl | bash, and other potentially dangerous operations. This pattern results in the execution of unvetted code from the internet directly on the host machine.
[COMMAND_EXECUTION]: The skill uses the Bash tool to perform high-risk operations, such as searching for secrets in system files and executing scripts generated by subagents based on untrusted documentation content.
[INDIRECT_PROMPT_INJECTION]: The skill processes untrusted data from the web and uses it to drive agent behavior, creating a large surface for indirect prompt injection.
Ingestion points: Data is retrieved from external URLs via WebFetch in Step 5 of the SKILL.md and in the subagent brief.
Boundary markers: The skill lacks robust delimiters or 'ignore' instructions, relying on simple placeholders like {{TASK_PROMPT}} which are insufficient to prevent a malicious document from hijacking the subagent's logic.
Capability inventory: The skill provides subagents with powerful tools including Bash, Write, and the ability to spawn additional sub-agents (Agent).
Sanitization: No sanitization or filtering is performed on the documentation content fetched from external sources before it is passed to the execution environment.

agent-experience