The Agent Skills Directory

[COMMAND_EXECUTION]: The skill executes a local script api_tester.py and a CLI binary api-tester located at ~/Documents/api-tester/. Since this code resides outside the skill package, its behavior cannot be verified, posing a risk of executing arbitrary or malicious commands.
[COMMAND_EXECUTION]: The installation instructions require the agent to run pipx install or pip install targeting a local directory. This process executes installation scripts (like setup.py) from that external directory, which could contain malicious logic.
[CREDENTIALS_UNSAFE]: The skill's primary function is to handle and process high-value secrets, including API keys for OpenAI, Anthropic, Google Gemini, and OpenRouter. It instructs the agent to read these secrets from files like keys.txt or .env files.
[DATA_EXFILTRATION]: The skill performs network operations by sending the collected API keys to external LLM provider endpoints. While the stated goal is validation, the use of an unverifiable local tool to transmit sensitive credentials to the network constitutes a potential exfiltration path.

api-tester