The Agent Skills Directory

[EXTERNAL_DOWNLOADS]: The skill facilitates the execution of the @steipete/oracle package directly from the NPM registry using npx -y. This bypasses user confirmation for downloading and running code from an external source that is not associated with a known trusted organization.
[DATA_EXFILTRATION]: The primary purpose of the skill is to aggregate local project files, including source code and documentation, and transmit them to external services such as OpenAI's API or ChatGPT browser sessions. It also supports sending data to arbitrary remote hosts via the --remote-host and --remote-token parameters, which could be used to exfiltrate sensitive repository data if misconfigured.
[COMMAND_EXECUTION]: The skill relies on shell command execution to run its core logic. It passes user-provided input (such as the <task> prompt and file globs) as arguments to the CLI tool, which may lead to command injection if the underlying tool does not safely handle shell characters.
[INDIRECT_PROMPT_INJECTION]: The skill reads untrusted data from the local file system and includes it in a prompt for a secondary AI model, creating a vulnerability surface.
Ingestion points: The tool reads file content based on the patterns provided to the --file argument in SKILL.md.
Boundary markers: The instructions do not specify the use of strict delimiters or protective boundary markers for the ingested file content within the generated prompt.
Capability inventory: The tool has the capability to read any file accessible to the agent and perform network operations to transmit that data.
Sanitization: While the documentation advises users to "redact aggressively" and "avoid secrets," there is no evidence of automated sanitization or filtering of malicious instructions embedded within the files being processed.

oracle