The Agent Skills Directory

[DATA_EXFILTRATION]: The skill is explicitly designed to locate and read highly sensitive files and credentials across a filesystem.
Evidence: The instructions direct the agent to access paths including ~/.ssh/, ~/.aws/credentials, ~/.kube, ~/.config/gcloud, .env files, shell histories, and messenger session directories (e.g., Telegram tdata).
Risk: Although the skill mandates that the agent mask the output (using a first4...last4 + sha256 format), the AI agent must process the full plaintext of these secrets to perform the scan and masking, creating a risk of exposure if the agent's context is compromised or if instructions are bypassed.
[COMMAND_EXECUTION]: The skill utilizes shell scripts and remote command execution to perform its functions.
Evidence: It executes a bundled script scripts/secret-sweep.sh and uses SSH to pipe this script to remote hosts via ssh -o BatchMode=yes <host> 'bash -s'.
Risk: Execution of shell scripts, especially when streamed to remote hosts, is a powerful capability that can be misused if the script content or the host parameters are manipulated.
[INDIRECT_PROMPT_INJECTION]: The skill's primary function involves ingesting and processing untrusted data from the filesystem, which serves as a significant attack surface.
Ingestion points: The agent reads shell histories, configuration files, and environment files (.env) which may contain attacker-controlled content.
Boundary markers: The instructions lack explicit delimiters or "ignore embedded instructions" warnings to separate the content of the files being scanned from the agent's operational instructions.
Capability inventory: The agent has the ability to execute shell commands locally and on remote machines via SSH.
Sanitization: There is no evidence of sanitization or escaping of the file content before it is processed by the subagents; masking is only applied to the final output summary.
[DYNAMIC_EXECUTION]: The skill dynamically constructs shell commands for execution on remote systems.
Evidence: It assembles SSH command strings that incorporate variables for hostnames, operating systems, and scan modes.

host-privacy-sweep