The Agent Skills Directory

[DATA_EXFILTRATION]: The skill instructs the agent to store and read sensitive credentials from a central directory (../secrets/) located outside the project repository. It specifically mentions handling GitHub PATs, SSH keys, cloud provider credentials (Azure/AWS), and application environment files. While this is a recognized method for keeping secrets out of version control, it grants the agent persistent access to a sensitive data store which is then used in conjunction with network-facing tools like CLI clients (gh, az) and a web browser.
Evidence: Found in SKILL.md and reference/credential-vault.md, which defines paths like ../secrets/github/pat.txt and ../secrets/vps/ssh/.
[INDIRECT_PROMPT_INJECTION]: The skill relies on browsing external websites via the cursor-ide-browser to automate workflows. This creates a surface for indirect prompt injection, as the agent ingests and processes untrusted data from the accessibility tree and page content of any site it visits.
Ingestion points: The browser_snapshot and browser_navigate tools (referenced in reference/browser-fallback.md) ingest content from external web pages into the agent's context.
Boundary markers: The skill does not provide specific instructions or delimiters to help the agent distinguish between its own system instructions and potentially malicious commands embedded in the websites it visits.
Capability inventory: The agent has extensive capabilities including file system access (reading/writing to the vault), network communication (browser, CLI tools), and interaction with shell environments.
Sanitization: There are no instructions for validating or sanitizing the content retrieved from the web before the agent acts upon it.
[COMMAND_EXECUTION]: The skill encourages the use of various CLI tools for automation, which involves spawning subprocesses with potentially sensitive arguments (like the credentials retrieved from the vault).
Evidence: Mentions of gh, az, and general 'cloud/vendor CLIs' in SKILL.md and reference/browser-fallback.md.

dont-be-lazy