The Agent Skills Directory

[CREDENTIALS_UNSAFE]: The skill instructs users on how to manually extract highly sensitive HttpOnly session cookies (__Secure-next-auth.session-token) from their browser's developer tools to authenticate the CLI. While the skill includes a warning against printing the token, the manual handling and storage of raw session credentials increases the risk of accidental exposure.
[COMMAND_EXECUTION]: The skill's primary function is to execute an "unofficial" CLI tool (flow). Running unofficial binaries that require full account session access introduces a significant supply chain risk, as the security and data-handling practices of the third-party tool are not verified.
[INDIRECT_PROMPT_INJECTION]: The skill ingests untrusted data from local files and images which are then processed by the agent and passed to the CLI tool. This creates a surface for indirect instructions to influence agent behavior.
Ingestion points: Files passed to the --prompt-file argument and images passed via --ingredient in SKILL.md.
Boundary markers: The skill lacks explicit delimiters or instructions to treat the content of these external files as untrusted data.
Capability inventory: The agent has the ability to execute shell commands (flow), read local files, and interact with a headed browser session (agent-browser).
Sanitization: There is no evidence of sanitization, validation, or escaping of the content found within the ingested prompt files before they are processed.

labflow