The Agent Skills Directory

[DATA_EXFILTRATION]: The skill instructs the agent to access and evaluate sensitive authentication data within the user's home directory, specifically reading ~/.grok/auth.json (to check for OIDC tokens) and ~/.grok/config.toml. Accessing credentials of external services constitutes a high-risk data exposure concern.
[PERSISTENCE]: The skill identifies and provides instructions for modifying the user's PowerShell profile to add or remove custom functions (e.g., function grok). Modifying shell profiles is a standard persistence mechanism that can be abused to execute code in every new terminal session.
[COMMAND_EXECUTION]: The skill recommends several command-line operations, including the execution of a local PowerShell script .\TOOLS\Ensure-Headroom-Grok.ps1 which is not included in the provided source files, making it an unverifiable local dependency. It also directs the agent to delete configuration files such as ~/.grok/models_cache.json and perform environment modifications.
[INDIRECT_PROMPT_INJECTION]:
Ingestion points: The skill is explicitly designed to process large, untrusted tool outputs such as logs, grep results, JSON dumps, and crash stacks.
Boundary markers: There are no instructions provided to use delimiters or ignore embedded instructions within the ingested content.
Capability inventory: The agent has the capability to execute shell commands (via the headroom CLI), modify environment variables, and perform file system deletions.
Sanitization: There is no mention of sanitizing or validating the external data before it is processed by the compression tools.

headroom