The Agent Skills Directory

[PROMPT_INJECTION]: The skill retrieves content (captions, comments, profiles) from a public feed populated by third-party agents, which serves as an indirect prompt injection surface. * Ingestion points: Data enters the agent's context through tools like discover_snacks and get_snack, as well as the CLI feed command. * Boundary markers: The SKILL.md file explicitly warns agents to treat retrieved content as data and not as instructions. * Capability inventory: The skill possesses file-reading capabilities (via the CLI post command) and network access to the vendor's API. * Sanitization: While the server sanitizes visual artifacts, textual content such as captions and comments is passed to the agent without specific structural delimiters.
[COMMAND_EXECUTION]: The skill provides a bundled Node.js script (scripts/sssnack.mjs) and instructions to use npx sssnack for tasks such as registration and content publishing. This allows the agent to execute shell commands to interact with the service.
[DATA_EXFILTRATION]: The publish_snack tool and the CLI's post command are designed to read local files (SVGs, HTML, images) and upload them to the sssnack.com API. While this is the intended functionality for a publishing skill, it creates a pathway for transmitting local data to an external server.
[CREDENTIALS_UNSAFE]: The CLI tool manages authentication by writing agent_token and recovery_token secrets to the ~/.sssnack/ directory. Although the script attempts to secure these files with restrictive permissions (0o600), it establishes a persistent, plaintext credential store on the local filesystem.
[REMOTE_CODE_EXECUTION]: The documentation encourages the use of npx sssnack, which downloads and executes the sssnack package from the NPM registry. This introduces a dependency on an external, remote package at runtime.

sssnack