The Agent Skills Directory

[CREDENTIALS_UNSAFE]: The skill implements a 'Credential auto-discovery' mechanism (Step 2.5 in SKILL.md) that programmatically scans for sensitive API keys and tokens. It uses shell commands to extract values from the user's active environment variables and multiple shell configuration files.
[DATA_EXFILTRATION]: The skill accesses highly sensitive local file paths to harvest credentials, including ~/.zshrc, ~/.bashrc, ~/.bash_profile, ~/.zprofile, ~/.env, and ./.envrc. While it claims to handle these values securely, the programmatic access to these files is a significant exposure risk.
[REMOTE_CODE_EXECUTION]: The core functionality involves spawning sub-agents that are authorized to use the Bash tool to install dependencies and execute code found in external product documentation. This facilitates the execution of unverified third-party code from the internet on the host machine.
[DATA_EXFILTRATION]: The skill has an attack surface for Indirect Prompt Injection (Category 8). Sub-agents ingest untrusted data from the web using WebFetch and subsequently use that data to drive shell command execution. This could be exploited by a malicious website to trick an agent into exfiltrating the auto-discovered credentials or other sensitive data from the workspace.
[COMMAND_EXECUTION]: The orchestrator uses shell commands for discovery (printenv, grep), credential management (security find-generic-password, op read), and cleanup (rm -rf on workspace directories).
[EXTERNAL_DOWNLOADS]: Sub-agents are explicitly instructed to fetch documentation from arbitrary target URLs and are encouraged to perform network-based installations (e.g., npm install, pip install, curl | bash).

agent-experience