The Agent Skills Directory

[EXTERNAL_DOWNLOADS]: The skill recommends global installation of the omniroute package via npm (npm install -g omniroute). This is an external dependency not belonging to a known trusted organization.
[COMMAND_EXECUTION]: The skill executes various subcommands of the omniroute CLI to perform audit, policy, and telemetry tasks, which involves running shell commands on the host system.
[CREDENTIALS_UNSAFE]: The logs command documentation includes an --api-key flag. Passing sensitive keys as command-line arguments can expose them in process monitoring tools or shell history.
[DATA_EXFILTRATION]: The logs command allows setting a --base-url, which provides a mechanism to send potentially sensitive log data to an arbitrary external endpoint.
[PROMPT_INJECTION]: The skill has an attack surface for indirect prompt injection:
Ingestion points: Untrusted data enters the agent context through the omniroute policy import <file> command and omniroute audit search <query> results.
Boundary markers: There are no instructions or delimiters provided to prevent the agent from executing instructions found within imported policies or search results.
Capability inventory: The agent can perform file system writes (audit export, policy export), network requests (implied by logs --base-url), and execute arbitrary omniroute subcommands.
Sanitization: There is no evidence of validation or sanitization of the content being imported or searched before it is processed by the agent.

cli-policy-audit