The Agent Skills Directory

[CREDENTIALS_UNSAFE]: The script scripts/tos_upload.py prints the raw JSON response containing cloud credentials—including the access key ID and secret access key—to the standard output in the get_credential_from_service function. This exposes sensitive secrets in the agent's logs and terminal output.
[INDIRECT_PROMPT_INJECTION]: The skill processes arbitrary URLs provided by the user, which serves as a vulnerability surface.
Ingestion points: The urls argument in scripts/file_download.py allows fetching data from any external source.
Boundary markers: None. The script does not use delimiters or instructions to ignore embedded commands in downloaded data.
Capability inventory: The skill includes functions to write to the local filesystem and upload data to external storage.
Sanitization: There is no validation or sanitization of the content downloaded from remote URLs.
[DATA_EXFILTRATION]: While intended for uploading agent outputs, the scripts/tos_upload.py utility can be directed to upload sensitive local files or entire directories (such as .ssh keys or .env files) to a remote TOS bucket, facilitating data exfiltration if the agent is compromised.
[COMMAND_EXECUTION]: The error handling instructions in SKILL.md direct the agent to write credentials directly to environment variable files in the workspace. This pattern of autonomous file modification could be abused to corrupt configuration files if the agent's file-write operations are not strictly restricted.

tos-file-access