The Agent Skills Directory

[COMMAND_EXECUTION]: The skill utilizes npx @useclawlink/cli to interact with Harvest. This involves executing the vendor's command-line interface to perform logins, connect services, and run specific actions.
[EXTERNAL_DOWNLOADS]: The skill downloads and runs the @useclawlink/cli package from NPM. As this package is owned by the vendor (clawlink-hq), this is standard behavior for the integration.
[CREDENTIALS_UNSAFE]: The skill notes that authentication tokens are stored locally at ~/.clawlink/credentials.json. This is the expected behavior for the CLI tool to maintain an authenticated session with the ClawLink service.
[INDIRECT_PROMPT_INJECTION]: The skill retrieves data from external Harvest accounts which is then processed by the agent. This represents a potential surface for indirect prompt injection if data within Harvest (such as task descriptions or project notes) contains malicious instructions.
Ingestion points: Harvest data retrieved via npx @useclawlink/cli run harvest (SKILL.md).
Boundary markers: Absent.
Capability inventory: Command execution via npx (SKILL.md).
Sanitization: Absent.

harvest