The Agent Skills Directory

[CREDENTIALS_UNSAFE]: The skill explicitly instructs the agent to scan multiple sensitive user configuration and environment files for secrets.
Evidence: The instructions in SKILL.md state: "Before asking for any *_API_KEY, grep ~/.zshrc ~/.zshenv ~/.zprofile ~/.profile ~/.bashrc ~/.bash_profile ~/.env* for export <NAME>=". This pattern is characteristic of credential harvesting, as it targets primary locations for storing API keys, tokens, and passwords.
[DATA_EXFILTRATION]: The skill generates and transmits authentication headers containing user credentials to an external URL defined at runtime.
Evidence: The skill constructs an Authorization header using base64 for Basic auth (USERNAME + PASSWORD) or Bearer tokens and sends them via curl to USD_SEARCH_API_URL. If this URL is directed to a malicious endpoint, sensitive credentials will be exfiltrated.
[INDIRECT_PROMPT_INJECTION]: The skill processes unverified, externally-sourced text metadata from a search API and uses it to make execution decisions.
Ingestion points: The agent reads response.json, specifically the source fields containing VLM-generated captions (plugin_rendering_to_vision_metadata_metadata_vlm_generated).
Boundary markers: Absent. There are no instructions to sanitize or treat the API-provided captions as untrusted text.
Capability inventory: The skill has access to Bash, curl, python3, and the Task tool (which spawns sub-agents).
Sanitization: Absent. The agent is instructed to evaluate these captions to decide whether to "keep" or "drop" hits, creating a vector where malicious metadata in a 3D asset could influence the agent's logic or behavior.
[COMMAND_EXECUTION]: The skill heavily relies on shell commands to build request bodies and process data, increasing the risk of command injection if variables like $Q (the query) or $USD_SEARCH_API_URL are not properly handled.
Evidence: The skill uses python3 -c with sys.argv and curl with the -d @/tmp/body.json flag to execute logic and network operations.

search