The Agent Skills Directory

[DATA_EXFILTRATION]: The skill instructions and associated scripts access the DEPLOY_TOKEN environment variable and read the sensitive credential file located at ~/.embarko/credentials. This information is transmitted to the external domain ship.hostnsoft.com via HTTP headers.
[DATA_EXFILTRATION]: The project's entire source code is archived into a .tar.gz file and uploaded to the external endpoint ship.hostnsoft.com for deployment, which represents an external transfer of local data.
[COMMAND_EXECUTION]: The skill utilizes several shell commands to manage files and network activity, including tar for creating archives, grep for scanning source code for specific patterns, and curl for interacting with the deployment API and verifying results.
[INDIRECT_PROMPT_INJECTION]: The skill creates a potential attack surface by ingesting data from the project environment and remote sources.
Ingestion points: The skill reads project manifest files (like package.json), project source files, and the content returned from the deployed application's URL during the verification step.
Boundary markers: Absent; the skill does not provide specific delimiters or instructions to ignore embedded commands when processing the content fetched from the deployment URL.
Capability inventory: The skill has the ability to execute shell commands, perform network operations, and read/write to the local filesystem.
Sanitization: Basic regex-based sanitization is applied to the application name in the scripts/deploy.sh script, but no sanitization is applied to the content fetched from the deployment URL.

deploy