The Agent Skills Directory

[REMOTE_CODE_EXECUTION]: The skill downloads and executes shell scripts directly from a remote domain using the pattern curl -fsSL onecli.sh/install | sh. This allows for arbitrary code execution from a third-party source without prior verification.
[COMMAND_EXECUTION]: The skill modifies shell initialization files (~/.bashrc and ~/.zshrc) to persistently alter the system PATH and ensure the downloaded tool is accessible.
[DATA_EXFILTRATION]: The skill performs a full read of the .env file (cat .env) to extract multiple sensitive API keys and OAuth tokens (e.g., ANTHROPIC_API_KEY, OPENAI_API_KEY). These are then passed to the external onecli utility.
[CREDENTIALS_UNSAFE]: Sensitive credentials harvested from the environment are passed as plain-text command-line arguments (--value <key>) to the onecli secrets create command. This exposes API keys to local process monitoring tools, system logs, and shell command history.
[COMMAND_EXECUTION]: The skill executes service management commands (launchctl on macOS and systemctl on Linux) to restart background processes after the configuration is modified.

init-onecli