The Agent Skills Directory

[PROMPT_INJECTION]: The skill instructs the agent to bypass interaction safety protocols. SKILL.md and shell.md explicitly command the agent to "infer intent and do it" without "asking for clarification" or "confirmation". This increases the risk of performing unintended actions based on ambiguous input.
[CREDENTIALS_UNSAFE]: The skill provides mechanisms for managing and potentially exposing sensitive authentication data. commands.md defines login, cookies, and headers commands that handle usernames, passwords, session cookies, and authorization tokens. Instructions in shell.md and state/cache.md describe storing this sensitive information in a local hidden directory .websh/ and plain-text session files.
[INDIRECT_PROMPT_INJECTION]: Fetching and parsing arbitrary web content creates a large attack surface. Ingestion points: The cd, follow, prefetch, and crawl commands ingest raw HTML from external, potentially untrusted URLs. Capability inventory: The skill has access to file writing, network operations, and background task execution via the Task, WebFetch, and Bash tools. Sanitization: The extraction prompts in state/cache.md and state/crawl.md lack explicit boundary markers or instructions to disregard commands embedded within the fetched HTML.
[COMMAND_EXECUTION]: The skill implements a comprehensive shell environment with high autonomy. It supports advanced features like piping, background execution, and job control, using the Bash and Task tools to execute commands autonomously. Automated scans detected SKILL.md as potential malware, likely due to the implementation of this web shell functionality.
[DATA_EXFILTRATION]: The combination of network access and sensitive data handling allows for potential exfiltration. The agent could be directed to read sensitive session or cache data and transmit it to an external URL using its network capabilities.
[TIME_DELAYED_CONDITIONAL]: The skill includes task scheduling capabilities. commands.md defines cron and at commands, allowing for the execution of commands at specific times or intervals, which could be used to facilitate persistent or hidden activity.

websh