The Agent Skills Directory

[DATA_EXFILTRATION]: The skill instructions and code snippets explicitly target and manipulate sensitive system paths, including the ~/.ssh/ directory and the ~/.ssh/config file. Access to these locations is considered high-risk as they contain credentials and connectivity configurations.
[COMMAND_EXECUTION]: The skill provides a shell script template (install.sh) that performs several active file system operations.
It uses ln -s, mkdir -p, mv, and rm to manage configuration files.
It uses chmod 600 and chmod 700 to modify permissions on sensitive directories and files.
It includes a curl command with an API key header (-H "X-API-Key: $KEY") to interact with a local Syncthing service API (localhost:8384).
[INDIRECT_PROMPT_INJECTION]: The skill creates an attack surface by ingesting and acting upon the contents of external Git repositories (dotfiles).
Ingestion points: Files within the cloned repository, such as shell configuration files, SSH configs, and the install.sh script itself.
Boundary markers: None; the skill assumes the repository content is trusted and does not provide mechanisms to isolate or ignore embedded instructions within the synced files.
Capability inventory: File system modification (write/delete/link), permission changes, shell script execution, and local network requests.
Sanitization: The skill lacks sanitization of the file contents being linked or the paths being created, relying on the user to verify the source repository.

dotfiles-multi-machine-sync