The Agent Skills Directory

[COMMAND_EXECUTION]: The skill executes a bundled Python script (scripts/review_server.py) to manage audit data and serve a local user interface.
The agent is instructed to run python3 "$SKILL_DIR/scripts/review_server.py" serve to launch the review environment.
The script validates and standardizes JSON audit results before display.
[DATA_EXFILTRATION]: The skill moves local audit data from the agent environment to the user's web browser via a loopback server (127.0.0.1).
Access is protected by a randomly generated, one-time access token (?token=...) to prevent unauthorized local access.
The server is restricted to the local interface and does not communicate with external domains.
[PROMPT_INJECTION]: The skill instructions contain strong defensive boundaries to protect the agent from malicious content in audited files.
It explicitly identifies SKILL.md, READMEs, and logs as "untrusted data" and commands the agent to never execute commands found within them.
It defines a multi-stage authorization flow (audit -> plan -> apply -> delete) to ensure no destructive actions occur without explicit user consent for each phase.
[INDIRECT_PROMPT_INJECTION]: The skill is designed to ingest untrusted data from other skills and plugins, creating a surface for indirect prompt injection.
Ingestion points: The agent reads SKILL.md files, plugin manifests, and configuration files from the local filesystem.
Boundary markers: The instructions mandate that the agent only extract evidence and ignore instructions or commands found in the analyzed data.
Capability inventory: The skill can read local files, write to a private state directory (~/.skill-slimming), and execute its own helper scripts.
Sanitization: The review_server.py script standardizes the data into a fixed schema, and the agent is instructed to use structured output for audit reports.

skill-slimming