The Agent Skills Directory

[CREDENTIALS_UNSAFE]: The skill's core instructions in SKILL.md explicitly permit and encourage the inclusion of sensitive secrets in the handoff packs, stating: 'Secrets are ALLOWED inside the pack — API keys, tokens, connection strings, credentials, private URLs.' This facilitates the movement of sensitive authentication material into files handled by the skill.
[DATA_EXFILTRATION]: The skill is designed to upload these secret-containing archives to external, third-party storage providers including x0.at, temp.sh, and envs.sh. The scripts/SERVICES.md file acknowledges these hosts are 'never trusted' and 'dumb storage,' yet the skill routinely exfiltrates agent state to these non-whitelisted public domains.
[EXTERNAL_DOWNLOADS]: The scripts/unpack.py and scripts/unpack.js tools allow for the retrieval of data from arbitrary URLs, which are then processed locally. The fetch functions in both scripts support HTTP/HTTPS protocols and handle redirects, facilitating the download of external artifacts.
[COMMAND_EXECUTION]: The skill makes extensive use of system command execution via subprocess.run (Python) and spawnSync (Node.js). These are used to invoke tar for archiving/extraction, curl for network transport, and openssl for legacy encryption tiers, as seen in scripts/backend.py, scripts/pack.py, and scripts/unpack.js.
[INDIRECT_PROMPT_INJECTION]: The skill processes untrusted external data that can influence agent state.
Ingestion points: Remote archive retrieval in scripts/unpack.py (via urllib.request) and scripts/unpack.js (via https.get).
Boundary markers: None; the extracted content is placed directly into the filesystem without prompt delimitation.
Capability inventory: Subprocess execution of tar, curl, and openssl; full filesystem write access within the destination directory.
Sanitization: scripts/unpack.py uses a safe_extract function to block path traversal (absolute paths or ..), and scripts/unpack.js implements similar string-based path filtering.

remote-handoff