The Agent Skills Directory

[CREDENTIALS_UNSAFE]: The skill provides instructions for the agent to interact with sensitive files and authentication credentials.
Accesses ~/.config/mxs/credentials.json, which contains access tokens, refresh tokens, and user profiles.
Utilizes environment variables MXS_TOKEN and MXS_API_KEY to authenticate CLI operations.
While the skill mandates that the agent must not print these secrets, the requirement to handle and pass them as command arguments or environment variables poses an exposure risk.
[COMMAND_EXECUTION]: The skill performs extensive operations by executing the mxs binary.
The agent is instructed to execute commands for resource management, including creation, modification, and deletion of posts, notes, and comments.
The skill also allows modification of server-side settings via mxs config set and mxs config edit.
[INDIRECT_PROMPT_INJECTION]: The skill processes data from external sources that could be controlled by an attacker to influence the agent's behavior.
Ingestion points: The agent fetches content such as posts, notes, snippets, and comments from a remote mx-space server using commands like mxs post get or mxs comment list.
Boundary markers: The skill uses specific output modes like --output llm and XML-like tags (e.g., <mxpost>, <mxnote>) to structure data, but it lacks explicit instructions for the agent to ignore or sanitize commands embedded within the fetched content.
Capability inventory: The agent has the authority to perform mutations, deletions, and configuration changes on the server, which could be triggered by malicious instructions in the processed data.
Sanitization: There is no mention of explicit sanitization or filtering of the fetched content before the agent processes it for further actions.

mxs-cli-ai-author