The Agent Skills Directory

[CREDENTIALS_UNSAFE]: The script scripts/_auth_discovery.py is designed to automatically discover and extract authentication tokens and API keys by scanning local directories such as ~/.codex, ~/.hermes, and ~/.openclaw.
[COMMAND_EXECUTION]: The skill utilizes subprocess.run to execute high-privilege system commands to retrieve stored passwords from the macOS Keychain (security find-generic-password) and the Linux Secret Service (secret-tool lookup) within scripts/_auth_discovery.py.
[COMMAND_EXECUTION]: The module scripts/_clipboard.py executes shell commands to interact with the host operating system's clipboard, using utilities such as powershell, pngpaste, osascript, wl-paste, and xclip.
[EXTERNAL_DOWNLOADS]: Functions in scripts/_common.py (specifically download_url and recover_media_url) perform arbitrary network downloads of media content from remote URLs using urllib.request.
[DATA_EXFILTRATION]: The skill is configured to transmit locally harvested credentials and system data (clipboard contents) to external API endpoints and third-party relay servers, which may include unverified infrastructure.

hellomedia