The Agent Skills Directory

[COMMAND_EXECUTION]: The script scripts/process.sh automatically deletes local files using rm -f after a successful upload. This behavior is enabled by default and can lead to unintended data loss if the skill is run on the wrong files.
[DATA_EXFILTRATION]: The skill uses curl to transmit local file data to an HTTP server. It resolves image paths directly from Markdown content without validating if they point to sensitive files or are contained within an expected directory. Consequently, a malicious Markdown file could trick the agent into uploading and subsequently deleting arbitrary local files (e.g., SSH keys or configuration files).
[EXTERNAL_DOWNLOADS]: The documentation references the installation of the PicList tool from its official GitHub repository, which is a standard requirement for the skill's core functionality.

piclist-upload