The Agent Skills Directory

[COMMAND_EXECUTION]: The skill requests standard shell access via bash and run_command tools. This capability is appropriate and necessary for its stated purpose of providing workflow automation and integration services.
[INDIRECT_PROMPT_INJECTION]: The skill has an attack surface for indirect injection as it processes external data from webhooks (integrations.md), RAG corpora (rag.md), and voice transcripts (voice.md).
Ingestion points: Webhook payloads, vector store chunks, and STT streams.
Boundary markers: The skill explicitly instructs the agent to "keep instructions out of untrusted input" in prompt.md and defines injection testing in audit.md.
Capability inventory: Uses bash, write_to_file, and run_command for automation tasks.
Sanitization: Implements HMAC verification for webhooks and webhook-guard.ts for payload size limiting to prevent DoS.
[DATA_EXFILTRATION]: The alert-router.ts script includes functionality to send data to external webhooks (Slack, Discord, Telegram). This is documented behavior for an alert routing system and uses standard environment variable configurations for destination URLs.
[PRIVILEGE_ESCALATION]: The browser-relay.md mode interacts with a local authenticated Chrome instance via a WebSocket relay (127.0.0.1:18795). While this grants high-level access to the user's browser sessions, the skill defines strict guardrails (Localhost binding, Zero Password Ingestion, and Redaction Gates) to mitigate risk.
[SAFE]: References to external services like Retell AI, Bland AI, Twilio, and Deepgram are documented for legitimate telephony and AI voice processing. All scripts use standard Node/Bun built-in modules (node:crypto, node:fs, node:util) without suspicious external dependencies.

automation