The Agent Skills Directory

[COMMAND_EXECUTION]: The skill includes Node.js scripts (audit-rolecard-security.mjs and check-security-baseline.mjs) that perform standard file system operations using built-in modules. These operations are used to read target files and write reports, with no evidence of arbitrary shell command invocation.
[DATA_EXFILTRATION]: The auditing tool identifies credential-shaped literals for reporting but implements redaction of secret values and skips sensitive files (e.g., .env, .pem, .key) during scanning to prevent data exposure.
[INDIRECT_PROMPT_INJECTION]: The skill is designed to analyze untrusted rolecard content. It mitigates potential injection risks by performing static analysis rather than execution, maintaining explicit trust boundaries, and providing instructions that strictly forbid executing or importing the audited material.

sillytavern-rolecard-security