The Agent Skills Directory

[DATA_EXFILTRATION]: Accesses the highly sensitive macOS iMessage database located at ~/Library/Messages/chat.db to retrieve private message contents for display purposes.
[COMMAND_EXECUTION]: Instructions in REFRESH.md guide the user to establish a persistence mechanism by adding the refresh_loop.sh script to the system crontab.
[COMMAND_EXECUTION]: The refresh_loop.sh script programmatically identifies and executes arbitrary AI CLI binaries from the system's PATH or the user-defined AI_CLI environment variable.
[COMMAND_EXECUTION]: The fallback_refresh.py script executes shell commands using subprocess.check_output to retrieve git status and branch information from repository paths specified in the configuration.
[REMOTE_CODE_EXECUTION]: Implements a pattern that pipes data from a local daemon directly to a Python interpreter (curl ... | python3). This pattern represents a risk if the source service is compromised.
[PROMPT_INJECTION]: The skill is vulnerable to indirect prompt injection because it ingests untrusted data from multiple external sources without sanitization or boundary markers.
Ingestion points: Fetches data from GitHub PRs (gh pr list), Gmail/Slack APIs, and the local iMessage database.
Boundary markers: None identified in the prompt instructions to delimit untrusted content.
Capability inventory: The skill has access to Bash, Read, and Write tools as defined in the metadata.
Sanitization: No evidence of input validation or escaping for the ingested content before it is processed by the agent.
[EXTERNAL_DOWNLOADS]: Fetches weather information from the wttr.in service and retrieves data from well-known platforms (GitHub, Google Calendar) to update widgets.

card-refresh