The Agent Skills Directory

[DATA_EXPOSURE]: The skill manages authentication tokens by reading and writing to a sensitive configuration file located at ~/.config/processon/credentials.json (Unix) or %APPDATA%\processon\credentials.json (Windows). While this is the intended purpose of the skill, the path is considered sensitive.
[COMMAND_EXECUTION]: The instructions direct the agent to execute local Python scripts (scripts/processon_setup.py) with various arguments (check, ui, setup) to manage the credential lifecycle. These scripts are part of the skill's internal tooling.
[INDIRECT_PROMPT_INJECTION]: The skill serves as a conduit for sensitive user-supplied data (ProcessOn Tokens), which presents an attack surface for indirect injection if not handled correctly.
Ingestion points: Authentication tokens enter the agent's workflow via a local loopback UI or a terminal-based hidden input prompt (in SKILL.md and references/workflow.md).
Boundary markers: The instructions include explicit prohibitions against the agent requesting or repeating the token in the chat interface, and specify that the token must only be pasted into the local password field.
Capability inventory: The agent uses local scripts to perform file system operations (writing credentials) and local network operations (loopback UI on a random port).
Sanitization: The skill documentation (in references/faq-deep.md) notes that the setup script normalizes the input by stripping prefixes like 'Bearer' before saving it to the filesystem.

processon-setup