The Agent Skills Directory

[COMMAND_EXECUTION]: The skill mandates the execution of shell commands to provide local notifications via curl to localhost:31337. It also requires the execution of Python-based tools like holehe and sherlock for identity verification and account discovery.
[EXTERNAL_DOWNLOADS]: The workflow instructions direct the agent to install third-party Python packages (holehe, sherlock-project) from external repositories using pip during the investigation process.
[PROMPT_INJECTION]: As an OSINT tool, the skill is designed to ingest and process large amounts of untrusted data from external websites, social media profiles, and public records. This creates a significant attack surface for indirect prompt injection, where malicious instructions embedded in a target's online presence could influence the agent's behavior.
Ingestion points: Social media profiles (LinkedIn, Facebook, Instagram), people-search aggregators, and public record databases across multiple workflows (FindPerson.md, SocialMediaSearch.md).
Boundary markers: None identified; findings from external sites are compiled directly into the investigation reports without protective delimiters.
Capability inventory: Shell command execution (curl, pip), file system appends (execution.jsonl), and network requests to various external domains across all scripts.
Sanitization: No explicit sanitization, filtering, or validation of external content is mentioned before the data is processed or reported.
[DATA_EXFILTRATION]: The skill collects detailed personal information and provides a mechanism to send data to a local port via curl. While currently directed at localhost, this pattern establishes a capability for data transmission that could be repurposed for remote exfiltration.
[CREDENTIALS_UNSAFE]: The skill instructions suggest checking a local directory (~/.claude/LIFEOS/...) for user preferences and configurations, which is a common pattern but may involve the handling of sensitive setup information. It also mentions access to paid services like PACER and BeenVerified, though it correctly avoids hardcoding credentials.

PrivateInvestigator