The Agent Skills Directory

[CREDENTIALS_UNSAFE]: The documentation explicitly describes how to access decrypted credential fields using the host.credentials.get(name) method. While it notes that these are redacted from printed output, they remain accessible in memory for use in subsequent tool calls or logic.
[DATA_EXFILTRATION]: The skill provides a comprehensive manual for accessing and extracting sensitive session metadata that could be used for exfiltration.
Accesses the execution_log table, which contains the exact source code submitted in all previous Python, R, and Bash cells.
Exposes the frames table and context_data JSON, which contain the full conversation array (_messages), token usage, and cost data for the entire project.
Accesses artifact_versions, exposing file content and lineage across the project.
Documents patterns for staging data for extraction by moving it between kernels (e.g., writing to handoff/q.json).
[COMMAND_EXECUTION]: The skill enables arbitrary SQLite execution through the host.query method. While restricted to read-only operations and a specific set of tables, it allows complex data manipulation and introspection within the session environment.
[PROMPT_INJECTION]: The skill creates a surface for Indirect Prompt Injection (Category 8) by encouraging the agent to process raw data from its own history.
Ingestion points: Data enters the context via SQL queries to tables like execution_log or frames (SKILL.md).
Boundary markers: The documentation does not provide instructions for using delimiters or boundary markers when the agent processes the resulting database records.
Capability inventory: The skill enables broad capabilities including SQL execution (host.query), LLM generation (host.llm), and agent delegation (host.delegate).
Sanitization: There is no evidence of sanitization or validation of the content retrieved from the database before it is re-interpolated into the agent's logic or prompts.

self-awareness