The Agent Skills Directory

[CREDENTIALS_UNSAFE]: The skill instructions direct the agent to harvest authentication credentials from the user's browser. Specifically, it targets Supabase session tokens stored in Chrome's localStorage under keys matching sb-…-auth-token to retrieve an access_token for database operations.
[COMMAND_EXECUTION]: The skill contains a directive to execute a local script (python3 app.py) if the helper application is detected as down. Since app.py is not provided within the skill's file set, this constitutes execution of an external, unverifiable script with the permissions of the agent's environment.
[DATA_EXFILTRATION]: The skill is configured to send process-related data, guardrail status, and 'cross-cutting findings' to multiple external sinks. This includes a local service at localhost:8765/api/review and a remote update feed via POST /api/update.
[INDIRECT_PROMPT_INJECTION]: The skill ingests untrusted data from multiple sources which represents a significant attack surface.
- Ingestion points: The skill reads external transcripts, company-specific process JSON files (data/<company>/processes.json), and a team update feed (GET /api/updates).
- Boundary markers: There are no instructions or delimiters provided to help the agent distinguish between legitimate process data and potentially malicious instructions embedded within the transcripts or team feeds.
- Capability inventory: The agent has the capability to execute shell commands (python3), perform network requests (GET/POST), and write directly to customer data via Chrome-MCP tools.
- Sanitization: The instructions do not specify any validation or sanitization steps for the ingested data before it is used to drive the rework logic or transmitted to other endpoints.

processflow-process