The Agent Skills Directory

[COMMAND_EXECUTION]: The skill instructs the agent to execute arbitrary system commands using the rbw CLI tool and tmux. It specifically mentions using exec to run commands like rbw config, rbw login, and rbw add, which involves managing interactive sessions and environment variables.
[DATA_EXFILTRATION]: The skill is designed to retrieve and process highly sensitive data, including passwords, TOTP tokens, and secure notes from a vault. This content is placed directly into the agent's context (e.g., via rbw get --full), creating a high risk of exposure or exfiltration if the agent is compromised by malicious instructions or if its context is shared with external services.
[PROMPT_INJECTION]: The skill is vulnerable to indirect prompt injection.
Ingestion points: Untrusted data enters the agent context via vault item names, notes, and fields retrieved through rbw list, rbw search, and rbw get (SKILL.md).
Boundary markers: No explicit delimiters or warnings are provided to the agent to treat vault content as untrusted or to ignore embedded instructions.
Capability inventory: The agent has the capability to execute shell commands via exec (SKILL.md).
Sanitization: No sanitization or validation of the retrieved vault content is performed before it is processed by the agent.

bitwarden