The Agent Skills Directory

[CREDENTIALS_UNSAFE]: The skill is explicitly designed to extract sensitive credentials from the local development environment. It reads One-Time Passwords (OTPs), magic links, and verification codes from the application log (log/development.log) using regex patterns. Additionally, it stores session cookies in a plain-text file (./.hotwire/cookies.txt) and provides utilities to bridge these credentials between curl and Playwright storage states.- [COMMAND_EXECUTION]: The skill relies on a suite of Bash and Ruby scripts that execute system commands such as curl, grep, tail, sed, and awk. These tools are used to orchestrate HTTP flows, parse log files, and manipulate session data. While primarily targeting the local environment, these scripts provide a functional path for automated shell-based interactions.- [INDIRECT_PROMPT_INJECTION]: The skill processes untrusted data from the local Rails server and log files which could theoretically be manipulated to influence the agent's behavior.
Ingestion points: scripts/readlog.sh (reading development logs) and scripts/submit_form.rb (parsing server-rendered HTML forms).
Boundary markers: Absent; the skill does not use specific delimiters or instructions to ignore embedded content in the logs or HTML.
Capability inventory: The skill can perform local network requests (curl, Net::HTTP), read/write local files (logs and cookie jars), and parse structured HTML content via Nokogiri.
Sanitization: Ingested data is processed via regex and CSS selectors without explicit sanitization or escaping before being presented in the agent context.

rails-hotwire-driver