The Agent Skills Directory

[CREDENTIALS_UNSAFE]: The script recall.mjs reads ~/.config/fast-ship/config.yaml to extract an api_key for the Fast Ship service. While this is used for authenticated API calls, it involves accessing hardcoded secrets in a local configuration file.\n- [DATA_EXFILTRATION]: The skill collects sensitive information including local worktree paths, branch names, and full conversation history from ~/.t3/userdata/statev2.sqlite. This data is subsequently passed to the agent and used to make network requests to the Fast Ship API endpoint specified in the user's configuration.\n- [COMMAND_EXECUTION]: The script executes several local CLI tools using execFileSync, including git for repository status, gh for GitHub PR details, and sqlite3 as a fallback for database queries.\n- [INDIRECT_PROMPT_INJECTION]: The skill is vulnerable to indirect prompt injection due to how it processes external data.\n
Ingestion points: Untrusted data enters the agent context from Git logs, GitHub PR titles/bodies, and T3 thread message payloads via scripts/recall.mjs.\n
Boundary markers: The skill lacks delimiters or instructions to ignore embedded commands within the ingested data.\n
Capability inventory: The skill has the ability to read local files, execute shell commands (git, gh, sqlite3), and perform network operations (fetch).\n
Sanitization: No sanitization or filtering is performed on the ingested content beyond simple string truncation for length.

recall