The Agent Skills Directory

[CREDENTIALS_UNSAFE]: The skill provides the agent with instructions to retrieve sensitive API keys using the command KEY=$(secrets lease typesense_api_key). While not hardcoded, this enables the agent to programmatically access live credentials.
[REMOTE_CODE_EXECUTION]: The skill uses SSH to execute commands on remote servers (e.g., ssh joel@flagg 'hostname && python3 --version ...'). This allows the agent to escape the local execution environment and execute arbitrary shell commands on remote infrastructure.
[COMMAND_EXECUTION]: The skill makes extensive use of shell-based tools including the joelclaw vendor CLI, curl, and jq to query databases, manage session data, and inspect local files.
[DATA_EXFILTRATION]: The skill accesses and processes raw agent session history logs stored at ~/.pi/agent/sessions/**/*.jsonl. These files contain detailed transcripts, commands run, and files touched, representing a significant data exposure risk if exfiltrated.
[PROMPT_INJECTION]: The skill is susceptible to indirect prompt injection (Category 8).
Ingestion points: Raw session transcripts in .jsonl files (e.g., ~/.pi/agent/sessions/).
Boundary markers: Absent; instructions direct the agent to 'Read the JSON' and 'extract bounded task context' without delimiters or warnings to ignore embedded instructions.
Capability inventory: The agent has access to shell execution (joelclaw), remote execution (ssh), network requests (curl), and credential retrieval (secrets).
Sanitization: The skill mentions redacting likely secrets but lacks sanitization or validation to prevent instructions embedded in past transcripts from influencing current agent behavior.

session-search