The Agent Skills Directory

[DATA_EXFILTRATION]: The skill discloses a comprehensive inventory of sensitive file paths and internal infrastructure details.
Evidence: Specifically identifies credential locations such as ~/.cursor/mcp.json, /opt/superseller-worker/.env, infra/*.env, and bot-config.json.
Evidence: Discloses a specific production IP address (172.245.56.50) for a worker server.
Evidence: Flags the presence of over 100 credentials in the version history of .env files and plaintext login credentials in configuration files.
[COMMAND_EXECUTION]: The skill provides instructions for high-privilege administrative access and the execution of custom deployment scripts.
Evidence: Explicitly instructs the agent to SSH as root into the production server at 172.245.56.50.
Evidence: Includes commands for service management and deployment such as pm2 restart and ./apps/worker/deploy-to-racknerd.sh.
[DATA_EXFILTRATION]: The skill creates a surface for indirect prompt injection by processing external tool and service outputs without validation.
Ingestion points: The skill ingests data from vercel env ls, shell command outputs, and various external API responses (Kie.ai, PayPal, Gemini).
Boundary markers: Absent; there are no clear delimiters or instructions to ignore embedded content within processed data.
Capability inventory: The agent has access to network operations via curl, remote command execution via ssh, and local file system access.
Sanitization: Absent; no evidence of escaping or schema validation for data retrieved from external environments.

credential-guardian