The Agent Skills Directory

[CREDENTIALS_UNSAFE]: Hardcoded cleartext credentials for a production service account are embedded directly in the skill file.
Evidence in SKILL.md: Username: zedai@wemabank.com, Password: Owzre !Er,s3-37.
The credentials are also hardcoded in the provided Python helper script: PASS = "Owzre !Er,s3-37".
[COMMAND_EXECUTION]: The skill provides a Python helper script that utilizes subprocess.run to execute external curl commands.
Evidence in SKILL.md: The get_token, query, and add_worklog functions in the Python script all use subprocess.run(["curl", ...]) to interact with the API.
[DATA_EXFILTRATION]: The skill provides ready-to-use commands and script logic designed to query and export sensitive organizational data and Personally Identifiable Information (PII).
Evidence in SKILL.md: Detailed examples for querying the CTM:People form which contains names, emails, phone numbers, and department details for bank staff.
Evidence in SKILL.md: Instructions for querying HPD:Help Desk, CHG:Infrastructure Change, and other forms containing sensitive internal business processes and incident details.

wema-bmc