The Agent Skills Directory

[COMMAND_EXECUTION]: The skill utilizes a shell script (scripts/pilot.sh) to interface with the KaloPilot API. The agent is instructed to invoke this script via bash and pass user-provided natural language queries as arguments. The script includes basic sanitization by escaping backslashes and double quotes when constructing the JSON payload for the API.
[EXTERNAL_DOWNLOADS]: The skill communicates with a remote API hosted at staging.kalodata.com. This domain is a vendor-owned resource associated with the KaloPilot service and is essential for the skill's stated purpose of providing TikTok Shop analytics. The script uses curl with a defined timeout to perform these operations.
[CREDENTIALS_UNSAFE]: The skill manages a user's API token by storing it in a local file at ~/.kalopilot/token. While stored in plain text, the skill specifically instructs the agent to use chmod 600 on the file to restrict access to the current user, following standard CLI tool practices for local secret management.
[INDIRECT_PROMPT_INJECTION]: The skill ingests data from a remote API, including analysis text and markdown reports. This represents an indirect prompt injection surface; however, the skill includes explicit rules for the agent to avoid fabricating data (e.g., report_url) and to relay service responses verbatim, which serves as a mitigation against hallucinatory or malicious content.

kalopilot