The Agent Skills Directory

[COMMAND_EXECUTION]: The skill performs network requests using curl with the -k (or --insecure) flag. This explicitly disables SSL/TLS certificate verification when interacting with the AgentMemory service, exposing the AGENTMEMORY_TOKEN and session data to potential man-in-the-middle (MITM) attacks.
[DATA_EXFILTRATION]: The skill transmits session context, including decisions and facts, to an external service at https://agentmemory.giatbh.io.vn/. This communication occurs with a non-whitelisted domain and involves sending a Bearer token in the request headers.
[INDIRECT_PROMPT_INJECTION]: The skill ingests untrusted data from user-provided feature requests and local wiki content, which it then uses to generate and dispatch tasks to other agents like Claude and OpenCode using the --inject parameter. This architecture lacks validation and boundary markers to prevent malicious instructions in the input from controlling the dispatched agents.
Ingestion points: User input ("propose ") and wiki files in llmwiki/wiki/ (referenced in SKILL.md).
Boundary markers: No explicit delimiters or instructions are used to separate untrusted content from the agent's control logic.
Capability inventory: The skill can execute multiple binaries (docker, gh, curl, orca), write to the filesystem, and manage other agents.
Sanitization: There is no evidence of filtering or escaping logic applied to external data before it is interpolated into task specifications.
[EXTERNAL_DOWNLOADS]: The skill synchronizes updates by cloning the rheinmir/setup repository from GitHub. While this uses the vendor's own namespace, it constitutes an external dependency that is fetched at runtime during the sync process.

orca-workflow