The Agent Skills Directory

[CREDENTIALS_UNSAFE]: The skill instructs the agent to collect and handle sensitive user credentials, including ZenTao accounts and passwords. It specifically guides the execution of zentao-cli auth login with the password provided as a command-line argument, which can expose credentials in process lists or shell history.- [CREDENTIALS_UNSAFE]: The skill directs the agent to read and write sensitive configuration data to files located at ~/.zentao-cli/config.toml and .zentao-cli/config.toml. Accessing and modifying these files represents a potential exposure of stored authentication tokens and service URLs.- [COMMAND_EXECUTION]: The skill utilizes several shell commands via the zentao-cli tool to manage authentication states and configuration settings (e.g., zentao-cli auth status, zentao-cli config set).- [COMMAND_EXECUTION]: The skill includes instructions to update the CLI tool and add additional skills using package managers (npm update -g zentao-cli and npx skills add zentao/cli), which involves executing remote code provided by the vendor.- [PROMPT_INJECTION]: The skill is susceptible to indirect prompt injection because it instructs the agent to monitor and act upon JSON output from the zentao-cli tool (specifically the _notice.update field). If the tool output is manipulated, it could influence the agent's behavior.
Ingestion points: The agent parses the standard output (JSON) of the zentao-cli command.
Boundary markers: None identified; the agent is instructed to process the _notice.update field directly.
Capability inventory: The skill has the capability to execute shell commands, manage local files, and suggest further package installations.
Sanitization: There is no evidence of sanitization or validation of the message content within the _notice.update field before it is presented to the user.

zentao-shared