The Agent Skills Directory

[CREDENTIALS_UNSAFE]: The skill instructions direct the agent to read sensitive configuration files such as agent.json and himalaya/config.toml. The documentation explicitly states these files contain sensitive credentials like client_secret, app_secret, and encrypt_key.
[COMMAND_EXECUTION]: The skill relies extensively on executing shell commands via the copaw CLI tool and various Python scripts to perform diagnostics, manage services, and process data.
[PRIVILEGE_ESCALATION]: The diagnostics and recovery procedures include instructions for using sudo systemctl restart copaw to manage system services and chmod +x to modify script execution permissions.
[INDIRECT_PROMPT_INJECTION]: The skill processes multiple external file formats, including Word (.docx), PowerPoint (.pptx), Excel (.xlsx), and PDF, which creates a surface for indirect prompt injection attacks where malicious content in a document could influence agent behavior.
Ingestion points: Document reading scripts such as scripts/office/validate.py and file reading functions described in references/builtin_skills.md.
Boundary markers: The instructions do not define boundary markers or explicit safety prompts to ignore instructions embedded within the ingested documents.
Capability inventory: The skill possesses capabilities for shell command execution, file system modification, and network-based operations (browser automation and email).
Sanitization: There is no mention of sanitization or content validation for the data extracted from office and PDF documents.

copaw-ops