The Agent Skills Directory

[CREDENTIALS_UNSAFE]: The scripts/patrol-snapshot.mjs file performs programmatic extraction of high-privilege system credentials.
It executes git credential fill via execFileSync to retrieve passwords and tokens from the system's git credential manager for various hosts.
It reads the local configuration file ~/.agents/env/forgejo.sh to obtain FORGEJO_TOKEN and other environment-specific secrets.
It processes sensitive environment variables such as T3_MCP_BEARER_TOKEN and T3_ACP_MCP_AUTHORIZATION to authenticate with MCP endpoints.
[COMMAND_EXECUTION]: The scripts/env-probe.mjs script contains a pattern allowing for arbitrary code execution on the local machine.
The --gc CLI argument is used to specify a file path that is subsequently executed using spawnSync(process.execPath, [gc, ...]). If an attacker can manipulate the arguments passed to this script, they can execute arbitrary JavaScript files with the permissions of the agent process.
[DATA_EXFILTRATION]: There is a documented mechanism that could be used for the exfiltration of sensitive credentials to external servers.
Credentials retrieved from the system's git storage are included in the headers of fetch requests sent to hostnames determined dynamically from pull request URLs and environment links.
Maliciously crafted PR metadata or environment configurations could trigger the transmission of user credentials to an attacker-controlled Forgejo or Gitea instance.
[INDIRECT_PROMPT_INJECTION]: The skill is vulnerable to indirect prompt injection because it ingests and processes untrusted data from multiple sources without adequate safeguards.
Ingestion points: Untrusted data enters the context through t3_thread_read (fetching thread history and tasks) and through external PR inspection tools (gh pr view, Forgejo API) which retrieve comments and review bodies.
Boundary markers: There are no delimiters or specific instructions provided to the agent to treat the ingested thread/PR content as untrusted or to ignore embedded instructions.
Capability inventory: The skill has access to network operations (fetch), local command execution (git, gh, node), and sensitive file access.
Sanitization: The skill does not perform any escaping, validation, or sanitization of the content fetched from external threads or PRs before utilizing it in the agent's decision-making flow.

t3-patrol