The Agent Skills Directory

[COMMAND_EXECUTION]: Employs osascript with do shell script to execute commands on the host machine from within a virtualized environment. This is used to bypass filesystem isolation and access host-level paths.
[COMMAND_EXECUTION]: Performs dynamic script generation by interpolating shell variables and user-provided strings directly into Python commands (python3 -c) and shell commands (curl). This creates a vulnerability surface for command injection if inputs are not properly sanitized.
[DATA_EXFILTRATION]: Accesses the sensitive local file ~/.toggl-config.json which contains private API credentials. While the skill transmits this data to the legitimate Toggl Track API (a well-known service), the combination of reading local secrets and performing network operations requires high trust.
[PROMPT_INJECTION]: The skill processes untrusted user data (such as entry descriptions and tags) and interpolates them into shell commands without boundary markers or explicit sanitization logic.
Ingestion points: User-provided descriptions, project IDs, and tags used in 'Start a timer' and 'Log a completed time entry' sections.
Boundary markers: Absent. The agent is not instructed to treat these inputs as untrusted data or use delimiters.
Capability inventory: Uses curl for network requests, osascript for host access, and python3 for logic execution.
Sanitization: None. The instructions rely on the agent to interpolate strings directly into shell execution templates.

toggl