The Agent Skills Directory

[DATA_EXFILTRATION]: The skill interacts with sensitive credential storage paths on the local filesystem. While necessary for managing the authentication lifecycle, these paths are sensitive targets.
References and manipulates the Colab CLI token file at ~/.config/colab-cli/token.json (SKILL.md, references/visible-auth-sidepanel.md).
References the Google Cloud Application Default Credentials (ADC) file at ~/.config/gcloud/application_default_credentials.json (SKILL.md, references/oauth-pkce-recovery.md).
[INDIRECT_PROMPT_INJECTION]: The skill exhibits an attack surface for indirect prompt injection by processing external authentication data.
Ingestion points: OAuth2 authorization codes provided by the user and authorization URLs generated by the CLI (SKILL.md, references/oauth-pkce-recovery.md).
Boundary markers: Absent. The skill does not define specific delimiters or warnings to isolate these external inputs from the agent's instructions.
Capability inventory: Execution of shell commands via the colab CLI and file deletion using rm (SKILL.md, references/visible-auth-sidepanel.md).
Sanitization: Absent. There is no mention of validating or escaping the authorization code before it is passed to the terminal process.
[COMMAND_EXECUTION]: The skill uses shell commands to manage and verify authentication states.
Executes colab subcommands such as whoami, sessions, and version (SKILL.md).
Executes rm -f to delete locally cached tokens during logout procedures (references/visible-auth-sidepanel.md).

colab-cli-authentication