The Agent Skills Directory

[COMMAND_EXECUTION]: The skill instructs the agent to use eval to process and export environment variables from local files. The implementation eval "$(grep ... | sed ...)" is highly vulnerable to command injection. Maliciously crafted lines in a .env file (e.g., using command substitution or backticks) would be executed by the shell during this process.
[DATA_EXFILTRATION]: The workflow directs the agent to read credentials from sensitive locations, specifically extending its search to ~/.env in the user's home directory. This represents unauthorized access to sensitive files outside the immediate project context, which may contain unrelated secrets or private keys.
[DYNAMIC_EXECUTION]: The skill dynamically generates and executes a Python script using python3 -c to handle API pagination and file writing. This runtime code generation incorporates job IDs and environment-derived credentials into an executed string.
[INDIRECT_PROMPT_INJECTION]: The skill is designed to crawl external websites and save their raw content to the local project. This creates a significant ingestion surface where untrusted data from the web could contain malicious instructions meant to subvert the agent's behavior in future tasks.
Ingestion points: Arbitrary external URLs provided as crawl targets (e.g., <TARGET_URL>).
Boundary markers: None. The skill saves retrieved content directly to files with only a minimal HTML comment indicating the source.
Capability inventory: The skill possesses network access (curl, urllib.request), filesystem write access (mkdir, open().write()), and environment variable access.
Sanitization: While filenames are sanitized for OS compatibility, the actual markdown content from external sources is written to the local disk without any sanitization or escaping of potentially malicious instructions.

cf-crawl