The Agent Skills Directory

[EXTERNAL_DOWNLOADS]: The skill instructs users to clone an external repository from https://github.com/motiful/cc-gateway.git that is not managed by a verified or trusted organization.
[REMOTE_CODE_EXECUTION]: Following the download, the instructions prompt the user to run npm install and various npm run commands, which executes code from the unverified external source.
[CREDENTIALS_UNSAFE]: The skill contains a script scripts/extract-token.sh specifically designed to extract sensitive OAuth refresh tokens from the macOS Keychain. Furthermore, it directs users to manually copy and store these authentication secrets into a plain-text config.yaml file and local environment variables.
[COMMAND_EXECUTION]: The skill executes multiple shell scripts, including scripts/extract-token.sh and scripts/client-setup.sh, which perform privileged or sensitive operations on the host system.
[INDIRECT_PROMPT_INJECTION]: The gateway architecture serves as an ingestion point for all LLM traffic, where the skill explicitly rewrites request bodies and prompt text (e.g., identity fields, environment objects, and home directory paths). This creates a vulnerability surface where crafted data from external sources could be processed by the gateway's logic without documented sanitization.
Ingestion points: Data enters the gateway context through the rewriteBody function and API proxying logic mentioned in SKILL.md.
Boundary markers: None identified in the provided documentation or rewriter examples.
Capability inventory: The gateway performs network operations, file system writes (addClientToConfig), and identity spoofing.
Sanitization: There is no evidence of input validation or escaping for the fields being rewritten or the headers being injected.

cc-gateway-ai-proxy