The Agent Skills Directory

[CREDENTIALS_UNSAFE]: The skill instructions explicitly direct the agent to read sensitive credential files from the local filesystem, specifically ~/Library/Application Support/com.vercel.cli/auth.json, to extract Vercel session tokens. It also relies on multiple sensitive environment variables such as PRIVY_PROJECT_SECRET and AI_GATEWAY_API_KEY.
[DATA_EXFILTRATION]: The skill is designed to aggregate and report on highly sensitive business and personal data, including user emails, Stripe billing history, and login activity across the platform. While the description claims this is for internal staff, the reliance on a simple keyword check ("recoup-internal") as a security gate is a weak protection against unauthorized use if the skill is available in a broader context.
[COMMAND_EXECUTION]: The skill executes local scripts and CLI tools with significant access:
Runs node scripts/privy_logins.mjs which performs authenticated network requests.
Executes stripe CLI commands using provided API keys.
Executes arbitrary SQL against a production Supabase database using the execute_sql tool.
[EXTERNAL_DOWNLOADS]: The skill performs numerous authenticated API calls to external services including api.privy.io, vercel.com, and ai-gateway.vercel.sh. While these are well-known services, the volume of data ingested into the LLM context increases the surface area for data exposure.
[PROMPT_INJECTION]: The skill uses a "recoup-internal" keyword as a gating mechanism. This is a form of soft constraint that could potentially be bypassed by an attacker attempting to trigger administrative functions without authorization.

recoup-internal-weekly-usage-review