The Agent Skills Directory

[COMMAND_EXECUTION]: The buttons.yaml manifest defines several commands that use the $(xclip -o) subshell expansion to retrieve data from the clipboard. This data is directly interpolated into shell commands (e.g., pi f36 test torque --part-id $(xclip -o)). If the clipboard contains shell metacharacters such as semicolons, pipes, or backticks, it could trigger unauthorized command execution when a Stream Deck button is activated.
[DATA_EXPOSURE_AND_EXFILTRATION]: The run.sh script sources the project's .env file (source "$PROJECT_ROOT/.env"). This action exposes all environment variables, which may include sensitive API keys or credentials, to the skill's environment.
[INDIRECT_PROMPT_INJECTION]: The skill has a significant attack surface for indirect prompt injection.
Ingestion points: Untrusted data enters the skill's context via the system clipboard (xclip -o in run.sh and buttons.yaml) and the barcode scanner (zbarcam in run.sh).
Boundary markers: No delimiters or "ignore instructions" prompts are used when processing the PART_ID or barcode data.
Capability inventory: The skill calls several other powerful skills, including agent-inbox (sending messages), episodic-archiver (permanent storage), and batch-quality (approving/rejecting material), and can capture images using fswebcam.
Sanitization: The skill lacks validation or escaping logic for the ingested data before passing it to sub-skills or logging it.
[UNVERIFIABLE_DEPENDENCIES_AND_REMOTE_CODE_EXECUTION]: The run.sh script relies on external system utilities such as fswebcam, zbarcam, and xclip, and instructs the user to install them via apt. This introduces a dependency on external software maintainers and system-level tools that operate outside the skill's immediate control.

ops-f36-plant