The Agent Skills Directory

[COMMAND_EXECUTION]: The core logic in scripts/env_manager.py makes extensive use of system-level command execution.
Evidence includes calls to subprocess.run and os.execvp for interacting with security (macOS Keychain), op (1Password CLI), launchctl, and systemctl.
These calls are used to manage credentials and project environment variables into the user's session.
[DATA_EXFILTRATION]: The probe command in scripts/env_manager.py implements a mechanism to send stored secrets to arbitrary external URLs provided via the --url argument.
The secret is transmitted in an HTTPS header (e.g., Authorization: Bearer <secret>).
While intended for API key validation, this capability serves as a functional exfiltration vector if the agent is directed to probe an attacker-controlled endpoint.
[PERSISTENCE]: The skill implements persistent access by modifying shell configuration files.
The sync-shell command in scripts/env_manager.py modifies ~/.zshenv to source a generated file (active.zsh) containing exported credentials.
This ensures the managed environment variables are loaded automatically in every new shell session.
[INDIRECT_PROMPT_INJECTION]: The skill possesses an attack surface for indirect prompt injection due to its data ingestion and execution capabilities.
Ingestion points: Reads local JSON profile data via scripts/profile_store.py and processes external HTTP responses during the probe command (though response bodies are explicitly ignored in the code).
Boundary markers: The SKILL.md contains explicit instructions to never report raw keys or secret references in chat logs.
Capability inventory: Includes file system writes (atomic_write_text), network requests (urllib.request), and shell command execution (subprocess.run).
Sanitization: Shell exports are sanitized using shlex.quote, and the probe functionality uses a custom redirect handler to prevent credential forwarding.
[DYNAMIC_EXECUTION]: The skill generates and sources executable shell scripts at runtime.
The sync-shell command creates active.zsh with file mode 0600 and populates it with export statements generated from the secret store.

lov-env-management