The Agent Skills Directory

[COMMAND_EXECUTION]: The skill uses shell commands and inline Python scripts to interact with the vendor's API.
Evidence: curl -s "https://api.iblai.app/..." | python3 -c "import sys,json;..." used to fetch and filter administrative usernames.
[EXTERNAL_DOWNLOADS]: The skill makes network requests to vendor-controlled domains to manage authentication and retrieve user data.
Evidence: Interactions with api.iblai.app, login.iblai.app, and os.ibl.ai.
[CREDENTIALS_UNSAFE]: The skill is designed to handle and store sensitive authentication tokens.
Evidence: Instructions to extract dm_token from browser localStorage and write the resulting IBLAI_API_KEY to a local .env file.
[PROMPT_INJECTION]: The skill contains an indirect prompt injection surface as it ingests data from external web pages.
Ingestion points: Reads username and organization keys from the rendered content of https://login.iblai.app/me (SKILL.md).
Boundary markers: No explicit delimiters or instructions are provided to the agent to ignore potentially malicious content embedded in the scraped page.
Capability inventory: The skill has the capability to execute shell commands (curl), run Python code, and write to the file system (.env, .gitignore).
Sanitization: No sanitization or validation of the scraped data is specified before it is used in subsequent operations or stored.

iblai-api-login