The Agent Skills Directory

[EXTERNAL_DOWNLOADS]: The skill instructs the agent to install the omniroute package globally via npm install -g omniroute or execute it directly using npx omniroute. These commands fetch and execute code from the public NPM registry.
[COMMAND_EXECUTION]: The skill is centered around executing various shell subcommands of the omniroute tool. A notable finding is the backup enable --cron <expr> command, which allows for the creation of persistence through scheduled cron jobs on the host system.
[CREDENTIALS_UNSAFE]: Several subcommands, such as backup create and backup status, utilize the --key-file <path> flag. This pattern involves the agent interacting with encryption keys or sensitive credential files stored on the file system.
[DATA_EXFILTRATION]: The skill facilitates sending local data to external targets through commands like sync push --target <t>, cloud create --repo <url>, and cloud auth. These operations involve network transmission of data to potentially untrusted or third-party cloud environments.
[PROMPT_INJECTION]: The skill possesses a surface for indirect prompt injection as it processes external data which is then used in powerful CLI operations.
Ingestion points: Untrusted data enters the context via omniroute cloud create --repo <url>, omniroute sync pull --source <s>, and omniroute sync import <bundlePath>.
Boundary markers: The instructions lack explicit delimiters or warnings to ignore instructions that might be embedded within the imported repositories or sync bundles.
Capability inventory: The skill has access to shell command execution (via all omniroute subcommands), file writing (via sync bundle <outPath>), network operations (via sync push and cloud create), and system persistence (via backup enable --cron).
Sanitization: There is no evidence of sanitization, validation, or filtering of the content retrieved from remote repositories or imported bundles before processing.

cli-backup-sync