The Agent Skills Directory

[REMOTE_CODE_EXECUTION]: The skill downloads and executes shell scripts from an external domain (onecli.sh) by piping the output of curl directly to the shell (sh). This pattern allows for the execution of arbitrary remote code on the host system.
[CREDENTIALS_UNSAFE]: The skill reads the entire contents of the project's .env file using cat and extracts sensitive credentials, including ANTHROPIC_API_KEY, CLAUDE_CODE_OAUTH_TOKEN, and OPENAI_API_KEY. It also instructs the agent to capture credentials directly from user chat responses.
[PERSISTENCE]: The skill modifies system configuration by appending environment variable exports to shell initialization files (~/.bashrc and ~/.zshrc) to persistently alter the system PATH.
[COMMAND_EXECUTION]: The skill executes various system-level commands, including managing Docker Compose stacks, restarting system services via systemctl and launchctl, and modifying local environment files.
[INDIRECT_PROMPT_INJECTION]: The skill contains logic to process data from external files (.env) and user-provided input, interpolating these values into shell commands (onecli secrets create) without sanitization or boundary markers.
Ingestion points: .env file content (via cat), user chat input.
Boundary markers: Absent; data is processed as raw strings.
Capability inventory: File system access (read/write), shell execution (curl, sh, docker, pnpm), and network access.
Sanitization: No evidence of validation or escaping for ingested data before command interpolation.

init-onecli