The Agent Skills Directory

[CREDENTIALS_UNSAFE]: The skill accesses sensitive credentials stored in ~/.readwise/env. It specifically relies on SESSION_COOKIES rather than standard API tokens for its operations.
[PRIVILEGE_ESCALATION]: The skill describes a process (readwise-custom auth session) that uses the Chrome DevTools Protocol (CDP) to extract httpOnly session cookies. This technique is designed to bypass browser security boundaries that normally prevent scripts from accessing these sensitive tokens.
[INDIRECT_PROMPT_INJECTION]: The skill performs synthesis (RAG) over the user's reading library, which contains data from external documents and highlights.
Ingestion points: User reading library and highlights (SKILL.md).
Boundary markers: None specified; content is synthesized across many documents without explicit delimiters.
Capability inventory: Shell command execution via readwise-custom and WebSocket streaming for communication.
Sanitization: No sanitization or filtering of the retrieved highlights is documented before they are processed by the LLM.
[METADATA_POISONING]: The skill references a non-existent "GPT-5.1" model in its description and technical details, which is misleading regarding its actual technical capabilities.

readwise-chat