The Agent Skills Directory

[DATA_EXFILTRATION]: Accesses sensitive local storage paths containing cryptographic materials.
The skill instructs the agent to interact with ~/.reticulum and ~/.lxmd/ directories, which are standard locations for Reticulum node configurations and identity files.
Specific tools like store_identities and store_destinations are designed to extract state from these sensitive locations.
Although the instructions advise sanitizing output to remove keys, the underlying ability to access identity files (which contain Ed25519 private keys) poses a risk of credential exposure.
[COMMAND_EXECUTION]: Directs the manual building and execution of local server binaries and daemons.
The documentation instructs the user/agent to compile a Go-based MCP server using go build and install Python packages via pip.
The skill describes the lxmd daemon's ability to use the --on-inbound flag, which executes a user-specified path on every received message, creating a high-risk surface for local code execution if configured maliciously.
[INDIRECT_PROMPT_INJECTION]: The skill processes messaging data originating from the Reticulum mesh network, an untrusted external source.
Ingestion points: Data is ingested through tools that read LXMF message payloads, titles, and custom fields from the network or local storage.
Capability inventory: The skill includes tools to read configuration and identity states and interacts with the local file system.
Boundary markers: No specific boundary markers or "ignore" instructions are provided to the agent for handling potentially malicious content embedded in LXMF messages.
Sanitization: While the skill mentions sanitizing configuration files, it lacks clear sanitization or validation logic for the content of messages received from the mesh, which could contain instructions targeting the agent's behavior.

lxmf