The Agent Skills Directory

[DATA_EXFILTRATION]: The skill accesses the sensitive file path ~/.env to retrieve authentication credentials (HIMARKET_PUBLISH_USERNAME, HIMARKET_PUBLISH_PASSWORD). These credentials, along with the full content of local SKILL.md files, are transmitted to an external endpoint defined by the HIMARKET_PUBLISH_URL variable.
[COMMAND_EXECUTION]: The skill utilizes several shell utilities to perform its operations, including curl for network requests, zip for packaging skill directories, jq for JSON processing, and mktemp for creating temporary archives. It also uses the source command to execute the contents of ~/.env, which could lead to arbitrary command execution if that file is compromised.
[PROMPT_INJECTION]: The skill processes untrusted local data, presenting an indirect prompt injection surface. Ingestion points: Content is read from SKILL.md files in a user-specified directory. Boundary markers: None are present to delimit untrusted data when used in internal logic. Capability inventory: The skill has the ability to perform network POST/PATCH operations and read/write files. Sanitization: Apart from truncating the description to 256 characters, no sanitization or escaping is performed on the ingested content before it is processed or uploaded.

publish-skills