The Agent Skills Directory

Dynamic Module Loading: The skill supports a plugin-like architecture for credential backends via the MURAL_KEYRING_BACKEND environment variable.
In scripts/mural/_backends.py, the code uses importlib.import_module and getattr to instantiate a custom keyring class specified by the user.
While this provides flexibility, it assumes that the environment in which the CLI runs is controlled by the operator, as controlling this variable could allow a user to execute code from any importable Python module.
Indirect Prompt Injection Surface: The skill correctly identifies that content authored by users in Mural (e.g., sticky notes, textboxes) is untrusted.
Documentation in SKILL.md and SECURITY.md explicitly warns that while the CLI encodes Mural payloads, it cannot detect malicious instructions embedded in user content.
Downstream agents consuming this data should treat it as untrusted input to avoid indirect injection attacks.
Credential Security: The skill implements a tiered approach to credential storage (environment, OS keyring, or file).
It enforces strict POSIX permissions (mode 0600) on local credential files and includes a mechanism to 'promote' file-based secrets to a secure system keychain when available.
A sensitive key registry (_REDACT_KEYS) is used to ensure tokens and secrets are scrubbed from stderr and log output.
SSRF and Redirect Protection: The transport layer includes several hardening measures.
The _NoRedirect handler explicitly blocks HTTP redirects for credential-bearing requests to prevent token exfiltration.
Asset uploads are protected by an SSRF allowlist in _validate_asset_url, restricting uploads to approved Azure Blob Storage endpoints.

mural