The Agent Skills Directory

[COMMAND_EXECUTION]: The scripts/tally.sh script executes shell commands including curl, jq, grep, cat, and printf to perform API operations and process local environment files.
[EXTERNAL_DOWNLOADS]: The skill communicates with the Tally API at https://api.tally.so to retrieve form data, list submissions, and manage webhooks.
[DATA_EXFILTRATION]: The form-create and form-update commands in scripts/tally.sh read the contents of a local file path provided as an argument and transmit that content to the remote Tally API. This capability can be misused to exfiltrate sensitive local files if the agent is directed to use a sensitive path as the form body.
[CREDENTIALS_UNSAFE]: The skill is designed to read API keys from ~/.claude/auth/tally.env or environment variables. While standard for CLI authentication, it involves the retrieval of credentials from the file system.
[PROMPT_INJECTION]: The skill has an attack surface for indirect prompt injection.
Ingestion points: Fetches external form submissions and response data via scripts/tally.sh submissions and scripts/tally.sh submission.
Boundary markers: No specific delimiters or "ignore instructions" warnings are used when processing retrieved form content.
Capability inventory: The skill provides a CLI script (scripts/tally.sh) capable of performing network operations and reading local files.
Sanitization: There is no evidence of sanitization or validation of form submission content before it is processed by the agent.

tally-api