The Agent Skills Directory

[COMMAND_EXECUTION]: The skill provides the agent with the ability to execute local scripts (lifx-api.sh, scene-status.py) to interact with smart home hardware via the LIFX API. These scripts are used to discover devices, toggle power, set colors, and activate scenes.
[DATA_EXFILTRATION]: The skill transmits control data and a personal access token to api.lifx.com. This is the legitimate endpoint for the LIFX cloud service and is necessary for the skill's functionality. This communication is documented and expected behavior for a smart-home integration.
[CREDENTIALS_UNSAFE]: The skill manages a sensitive LIFX API token. The setup process (setup.sh) instructs users to provide this token, which is then stored in a local hidden file (.lifx-token) with restricted file system permissions (chmod 600). This is a standard and acceptable method for local credential storage in CLI-based tools and avoids hardcoding secrets.
[INDIRECT_PROMPT_INJECTION]: The skill ingests device names and scene labels from the LIFX API. These strings are used to populate the skill manifest and are interpreted by the agent to map natural language to specific IDs. While this creates a theoretical injection surface if a user's LIFX account data is maliciously crafted, the scope is limited to the agent's lighting control commands.

lifx