The Agent Skills Directory

[PROMPT_INJECTION]: The skill instructions explicitly direct the agent to override standard clarification and confirmation steps, reducing human oversight.
Evidence: SKILL.md: 'No asking for clarification. Just execute.'
Evidence: shell.md: 'Don't ask for clarification... Just do it.'
Evidence (Indirect Prompt Injection Surface): The skill fetches untrusted web content and processes it via subagents.
Ingestion points: WebFetch output and .parsed.md files.
Boundary markers: Absent in subagent prompts.
Capability inventory: WebFetch, Task, Bash, Write, Read.
Sanitization: Absent.
[COMMAND_EXECUTION]: The skill provides the agent with extensive autonomous capabilities, including task scheduling and API mounting.
Evidence: commands.md: Defines cron and at for recurring and scheduled tasks.
Evidence: commands.md: Defines mount to attach external REST, GitHub, and RSS APIs.
Evidence: shell.md: Instructs the agent to handle most operations via background haiku subagents.
[CREDENTIALS_UNSAFE]: The skill includes functionality for managing sensitive user authentication data.
Evidence: commands.md: Commands for setting COOKIE_session and HEADER_Authorization.
Evidence: commands.md: login command for capturing credentials and su for profile switching.
[DATA_EXFILTRATION]: The combination of autonomous network fetches and credential management allows for potential silent data harvesting.
Evidence: The skill can read stored cookies and headers and then perform background WebFetch or mount calls to external servers.
[EXTERNAL_DOWNLOADS]: The skill enables automated, recursive, and background downloading of arbitrary external content.
Evidence: state/crawl.md: Describes Eager Link Crawling which prefetches pages multiple layers deep automatically.

websh