The Agent Skills Directory

[DATA_EXFILTRATION]: The skill's primary tool r2_upload allows the agent to read arbitrary local files and upload them to a remote storage endpoint. This functionality represents a high-risk exfiltration vector if an attacker manages to influence the agent's choice of file path.
[INDIRECT_PROMPT_INJECTION]: The skill is vulnerable to indirect prompt injection due to the lack of validation on the file_path and key arguments in src/index.ts.
Ingestion points: The file_path argument is taken directly from the agent's context and used to read local files.
Boundary markers: The instructions in SKILL.md do not include delimiters or warnings for the agent to verify the sensitivity of the files it is asked to upload.
Capability inventory: The skill combines local file reading (readFile in src/index.ts) with network transmission to remote S3 endpoints (PutObjectCommand).
Sanitization: There is no sanitization or block-listing for sensitive file paths (e.g., ~/.ssh/, .env, /etc/shadow) or file types.
[CREDENTIALS_UNSAFE]: The skill manages highly sensitive S3/R2 credentials. Although the onboard.ts script correctly sets file permissions to 0600 for the configuration file, the interactive setup process involves entering plaintext credentials into a terminal, which could be captured by local logging or history.

r2-upload