The Agent Skills Directory

[DATA_EXFILTRATION]: The skill directs the agent to access sensitive credential files in the user's home directory, specifically ~/.secrets/cmux.env, ~/.secrets/cmuxterm-dev.env, and ~/.secret/cmuxterm.env. These files are stated to contain private keys such as FREESTYLE_API_KEY and R2 storage variables, posing a high risk of data exposure.
[COMMAND_EXECUTION]: The skill provides shell command patterns to source these secret files (source ~/.secrets/cmux.env), facilitating the loading of sensitive credentials into the shell environment where the agent operates.
[INDIRECT_PROMPT_INJECTION]: The skill defines a surface for indirect prompt injection by processing untrusted request data in Vercel route handlers (web/app/api/**). While it suggests running programs at a boundary, the combination of data ingestion and high-privilege capabilities (database writes, VM lifecycle management) creates a potential vulnerability. Evidence chain: 1. Ingestion points: Next.js route handlers. 2. Boundary markers: Parsing and running programs at the handler boundary. 3. Capability inventory: Postgres database access and Cloud VM provider integrations. 4. Sanitization: Implicitly handled via request parsing but not explicitly defined with strict schema validation.

cmux-backend