The Agent Skills Directory

[CREDENTIALS_UNSAFE]: The skill requires the user to grant 'Always Allow' access to the macOS Keychain so it can read browser cookies for authentication. This exposes sensitive session tokens for Overleaf (and potentially other sites stored in the same keychain) to the agent and the underlying CLI tool.
[PRIVILEGE_ESCALATION]: The instructions explicitly guide the user to grant persistent, unrestricted keychain access to the third-party tool on macOS, bypassing standard operating system security prompts that normally require per-access authorization.
[EXTERNAL_DOWNLOADS]: The skill depends on 'pyoverleaf', a package hosted on an untrusted GitHub repository (jkulhanek/pyoverleaf). This introduces a supply chain risk as the agent is instructed to install and run code from a third-party source not affiliated with the skill author or a known trusted vendor.
[COMMAND_EXECUTION]: The skill utilizes the 'run_terminal' tool to execute shell commands with 'pyoverleaf'. Maliciously crafted filenames or project names from an external Overleaf project could lead to command injection if not properly handled by the underlying CLI.
[METADATA_POISONING]: The SKILL.md file contains a 'Security audit' section that claims a specific version of the third-party tool is safe. These claims are unverifiable and represent a deceptive pattern that may mislead users into lowering their security posture or skipping manual review.
[INDIRECT_PROMPT_INJECTION]: 1. Ingestion points: The skill reads LaTeX file content from external Overleaf projects via 'pyoverleaf read'. 2. Boundary markers: No delimiters or instructions are provided to the agent to ignore potential instructions embedded within the LaTeX data. 3. Capability inventory: The skill has access to terminal execution, file system writes, and project modification tools ('rm', 'write'). 4. Sanitization: There is no evidence of sanitization or filtering applied to the data fetched from Overleaf before it is processed by the agent.

inno-rclone-to-overleaf