The Agent Skills Directory

[CREDENTIALS_UNSAFE]: The skill documentation includes hardcoded sensitive data that should not be stored in plain text.
Evidence: A plain-text password 7Te1UudOE54aU79xrZ (identified as an old RackNerd password) is listed in the 'Banned Values' table.
Evidence: An API key 6bb5a5733b79dc30f42ea4ab6a95b9a0 is exposed within the 'Banned Values' documentation.
[COMMAND_EXECUTION]: The skill instructs the agent to execute shell commands that interact with the host and remote systems.
Evidence: An SSH command ssh root@172.245.56.50 'grep SHAI_OPS_GROUP_ID /opt/superseller-worker/apps/worker/.env' targets a specific remote IP and attempts to read a sensitive environment file.
Evidence: The 'Manual Run' section provides a command using npx tsx -e to execute arbitrary TypeScript code from the shell, which could be abused if modified.
[DATA_EXPOSURE]: The skill facilitates access to sensitive files and database tables.
Evidence: Instructions to read from a worker's .env file, which typically contains production secrets and API tokens.
Evidence: Direct SQL queries to read from the agent_findings table on a production database.

autonomous-agents