The Agent Skills Directory

[EXTERNAL_DOWNLOADS]: The skill requires the installation of a global Node.js package ("npm install -g fieldtheory") and provides a command to download and install a binary Mac application ("ft install app") from an external domain.
[CREDENTIALS_UNSAFE]: The tool is designed to extract sensitive session cookies (such as "ct0" and "auth_token") directly from browser databases (Chrome, Firefox, etc.) to authenticate with social media platforms. It also stores OAuth tokens locally in "~/.fieldtheory/bookmarks/oauth-token.json" with specific permissions.
[PERSISTENCE]: The skill includes functionality to install scheduled background tasks on the host system using the "ft possible nightly install" command, which creates recurring execution points for the tool.
[INDIRECT_PROMPT_INJECTION]: The skill processes untrusted external data by syncing and indexing X/Twitter bookmarks, which are then used as context for LLM classification and question-answering tasks.
Ingestion points: Syncs raw bookmark content from X/Twitter APIs and browser caches to "~/.fieldtheory/bookmarks/bookmarks.jsonl".
Boundary markers: The documentation does not specify the use of delimiters or isolation when bookmarks are passed to the LLM for classification or via the "ft ask" command.
Capability inventory: The tool has extensive capabilities including file system read/write, network synchronization, and local shell execution.
Sanitization: No explicit sanitization or filtering of bookmark text is described before it is processed by the "ft classify" or "ft ask" tools.
[COMMAND_EXECUTION]: The documentation provides programmatic examples using "child_process.execSync" to run CLI commands, which could be exploited for command injection if user-provided search queries or folder names are not properly escaped.

fieldtheory-cli