The Agent Skills Directory

[COMMAND_EXECUTION]: The skill executes shell commands to load environment variables and run the starlingcli tool through op run. It also requires verifying the existence of the CLI tool using command -v.
[EXTERNAL_DOWNLOADS]: The skill relies on an external dependency, starlingcli, which is hosted on GitHub at https://github.com/howells/starlingcli. This repository is owned by the skill author.
[DATA_EXFILTRATION]: The skill accesses a sensitive local environment file at /Users/danielhowells/.codex/plugins/secrets/1password-service-account.env to load a 1Password service account token into the process environment. While this is used for legitimate secret management, it involves accessing sensitive credential files on the host system.
[INDIRECT_PROMPT_INJECTION]:
Ingestion points: Financial transaction history and account metadata are ingested as JSON output from starlingcli (SKILL.md).
Boundary markers: The instructions do not define specific delimiters or warnings for the agent to ignore instructions embedded within transaction descriptions.
Capability inventory: The agent has the capability to execute shell commands via op run and access the local file system (SKILL.md).
Sanitization: There is no explicit requirement to sanitize or filter transaction data (such as merchant names or payment references) which could contain malicious instructions designed to influence the agent's follow-up actions.

starling