The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill creates a vulnerability surface for data exposure because it follows user instructions to upload local files to a public URL.
Ingestion points: User-supplied file paths and filenames via triggers like "upload this" or "share this file" in SKILL.md.
Boundary markers: No explicit delimiters or instructions are present to prevent the agent from processing sensitive system paths (e.g., SSH keys or environment files) if requested by a user.
Capability inventory: The skill utilizes curl with the @path syntax to read local files and performs network PUT requests to remote endpoints at stableupload.dev.
Sanitization: There is no evidence of path validation, file type filtering, or content sanitization before transmission.
[COMMAND_EXECUTION]: The skill provides instructions to execute shell commands using curl to transmit binary file data from absolute local paths to remote storage buckets.
[EXTERNAL_DOWNLOADS]: The skill instructs the agent to download and execute the agentcash CLI tool directly from the npm registry using the npx agentcash@latest command.

upload-and-share