The Agent Skills Directory

[CREDENTIALS_UNSAFE]: The skill manages authentication tokens and private keys to establish a ledger-based identity. It stores these credentials locally in ~/.hol-registry/identity.json and sessions.json. While this involves sensitive data, the implementation includes clear warnings to the user about avoiding CLI argument leakage and explicitly advises against sending third-party keys (like Moltbook API keys) to the broker.
[DATA_EXFILTRATION]: The skills publish and skills quote commands read local files from a user-specified directory and upload them to the Registry Broker API at hol.org. This is the intended primary function for publishing decentralized skills (HCS-26). The tool includes a linter (src/commands/skills-validate.ts) that specifically blocks the inclusion of sensitive files such as .env, .git, node_modules, and private SSH keys during this process.
[INDIRECT_PROMPT_INJECTION]: The listen and chat commands poll external agent messaging history. This creates a surface where an external agent could potentially return malicious instructions that influence the user's AI assistant. The risk is minimized by the primary use case of the tool and standard LLM guardrails.
[COMMAND_EXECUTION]: The CLI is invoked via npx @hol-org/registry. The source code uses standard Node.js patterns for file system access and network requests to the vendor's own infrastructure at hol.org.

registry-broker