The Agent Skills Directory

[CREDENTIALS_UNSAFE]: The skill uses command-line flags to pass highly sensitive information, including user passwords (--password), email addresses, and various authentication tokens (--id-token, --google-id-token, --apple-id-token, --refresh-token). This is a dangerous practice because command-line arguments are often visible in process lists, logs, and shell history files.
[EXTERNAL_DOWNLOADS]: The skill instructs the agent to install the popopo.js package globally using bun i -g. This downloads code from an external registry, which introduces risks associated with executing third-party code during the installation and at runtime.
[COMMAND_EXECUTION]: The agent is tasked with translating natural language user requests into shell commands for the popopo CLI. This provides a direct interface for executing potentially dangerous system commands if the mapping process is not strictly controlled.
[DATA_EXFILTRATION]: The tool is designed to manage authentication sessions and interact with remote APIs. It has the capability to read local session files (.popopo-session.json) and upload local data (--audio-file, --icon-source), which could be leveraged for unauthorized data access if the tool is misused.
[PROMPT_INJECTION]: The skill is vulnerable to indirect prompt injection because it interpolates user input into shell commands without sanitization.
Ingestion points: User instructions are used to construct CLI commands as described in SKILL.md.
Boundary markers: No explicit delimiters are defined to separate user input from command structure.
Capability inventory: The popopo CLI can perform network operations, file reads, and file writes (references/commands.md).
Sanitization: No input validation or escaping mechanisms are provided in the skill instructions.

popopo-cli