The Agent Skills Directory

[DATA_EXFILTRATION]: Automated scanners (URLite) have identified integrations.sh as a phishing domain. The skill sends user-provided search terms and domain metadata to this service via network requests in cli.ts, potentially exposing sensitive information.
[EXTERNAL_DOWNLOADS]: The skill dynamically fetches its operational schema and registry data from https://integrations.sh/openapi.json and https://integrations.sh/api.json. These resources are hosted on a domain with active security alerts for phishing.
[EXTERNAL_DOWNLOADS]: The CLI tool performs periodic update checks by fetching metadata from the official NPM registry (https://registry.npmjs.org/integrations). This is a routine operation targeting a trusted repository.
[PROMPT_INJECTION]: The skill processes data from external integration records that can contain embedded instructions in fields such as setup and description.
Ingestion points: Data retrieved from the integrations.sh API and processed in cli.ts and core.ts.
Boundary markers: None identified. There are no instructions for the agent to ignore or sanitize commands found within the data fields.
Capability inventory: The skill allows the agent to perform network lookups and discovery operations.
Sanitization: The skill does not validate or sanitize the string content of integration records before presenting them to the agent.

integrations-sh