The Agent Skills Directory

[CREDENTIALS_UNSAFE]: The skill instructs the agent to programmatically harvest authentication credentials from the browser environment.
Evidence: Instructions in Phase 3 specify pulling the session token (sb-…-auth-token → access_token) and the anonymous API key from the browser's localStorage.
[DATA_EXFILTRATION]: The skill reads potentially sensitive local customer data and transmits it to a remote endpoint.
Evidence: The agent is directed to read meeting transcripts from technical-analysis/<company>/meeting-notes.txt and subsequently perform a POST request to /api/update (targeting the processflow.neverlost.at infrastructure) containing extracted industry details, ERP system names, and customer priorities.
[COMMAND_EXECUTION]: The skill triggers the execution of local scripts to process data.
Evidence: Phase 4 executes processflow-review/scripts/select.py using locally stored process and score JSON files as arguments.
[INDIRECT_PROMPT_INJECTION]: The skill has a high surface area for indirect injection as it processes untrusted external transcripts and feeds the results into scripts and network calls.
Ingestion points: technical-analysis/<company>/meeting-notes.txt (File System).
Boundary markers: None; the agent is instructed to "Read it fully first" and treat it as "ground truth."
Capability inventory: Script execution (select.py), network transmission (POST /api/update), and browser interaction (accessing localStorage).
Sanitization: No evidence of sanitization or filtering for the content extracted from transcripts before it is used in CLI arguments or API payloads.

processflow-overview