The Agent Skills Directory

[COMMAND_EXECUTION]: The skill performs various shell commands on a remote host via SSH. These actions include installing Docker, managing containers, and executing Python scripts to update pricing in a database. All commands are integral to the stated purpose of the skill and are guarded by a robust validation library (scripts/lib/validation.sh) that uses strict regular expressions to prevent command injection via user-supplied variables.
[EXTERNAL_DOWNLOADS]: The skill downloads the NewAPI container image. It correctly uses an immutable SHA256 digest (calciumion/new-api@sha256:...) as specified in scripts/deploy_newapi.sh, which is a security best practice to prevent supply chain attacks through tag-shifting.
[CREDENTIALS_UNSAFE]: The skill handles sensitive OAuth credentials and API keys. It employs secure patterns by instructing the agent to fetch keys from the system password manager (e.g., security find-generic-password) and synchronizing credential files from a local machine to the remote host via scp. There are no hardcoded secrets; placeholders like cpa_xxx and sk-xxx are used for demonstration purposes only.
[DATA_EXFILTRATION]: No patterns of unauthorized data exfiltration were detected. The skill focuses on synchronizing user-owned credentials to a user-owned VPS for the purpose of proxying AI requests.
[PROMPT_INJECTION]: The instructions in SKILL.md include self-imposed constraints to ensure the agent remains honest and bases its conclusions on verifiable command output (e.g., "All '完成' conclusions must be based on command output from this session"). No malicious injection or bypass patterns were found.
[REMOTE_CODE_EXECUTION]: The skill uses ssh ... bash -s and ssh ... python3 - to execute logic on the target host. While this constitutes remote code execution, it is the primary intended function of a deployment skill and is implemented using safe data-passing techniques (such as json.dumps() in Python to avoid injection into generated scripts).

cliproxy-newapi-stack