The Agent Skills Directory

[COMMAND_EXECUTION]: The script scripts/configure-keyapi-auth.mjs modifies user shell profile files (e.g., .zshrc, .bashrc, .profile, and PowerShell profiles) to store the KEYAPI_TOKEN environment variable, which establishes a persistence mechanism on the host system.
[DATA_EXFILTRATION]: The authentication script reads sensitive shell configuration files to check for and manage credentials. The skill also performs network operations to the external domain api.keyapi.ai to retrieve TikTok data.
[PROMPT_INJECTION]: The skill ingests and processes content from external API responses and documentation pages, which presents a surface for indirect prompt injection attacks.
Ingestion points: scripts/keyapi-api.mjs fetches live data from the TikTok API, and scripts/search-keyapi-docs.mjs retrieves remote documentation content.
Boundary markers: The skill does not implement explicit delimiters or instructions for the agent to isolate and ignore potentially malicious instructions embedded in the external content.
Capability inventory: The agent is authorized to execute local scripts, write to the file system, and perform network requests.
Sanitization: No explicit sanitization or validation of the fetched external content is performed before processing.

keyapi-tiktok