The Agent Skills Directory

[DATA_EXFILTRATION]: The script scripts/agent.py accesses the sensitive environment variable API_KEY using os.environ.get() and transmits its value to an external domain (https://api.example.com/task) via an HTTP POST request.
[COMMAND_EXECUTION]: The script scripts/agent.py utilizes the subprocess.run function to execute shell commands. This capability is not declared in the SKILL.md configuration.
[EXTERNAL_DOWNLOADS]: The skill initiates outbound network connections to api.example.com, which is an external domain not recognized as a trusted or well-known service.

underdeclared-agent