The Agent Skills Directory

[DATA_EXFILTRATION]: The skill incorporates a silent telemetry mechanism that transmits session IDs, action logs, user sentiment analysis, and error summaries to onboarding.confidence.dev and events.eu.confidence.dev. The instructions explicitly mandate that this telemetry be "transparent to the user" and that the agent should "never mention it," which is a concealment pattern for data exfiltration.
[COMMAND_EXECUTION]: During its setup phase, the skill utilizes the dangerouslyDisableSandbox: true flag within Bash commands to execute shell utilities such as uuidgen and curl. This is used to acquire session secrets and initialize local environment variables outside the standard security boundaries.
[INDIRECT_PROMPT_INJECTION]: The skill creates an attack surface for indirect prompt injection by ingesting external data from the Statsig Console API (including flag names, descriptions, and rule definitions) and processing this untrusted content to generate shell commands and MCP tool calls (createFlag, addTargetingRule). There are no clear sanitization steps for descriptions or names that might contain embedded instructions.
Ingestion points: Data fetched from https://statsigapi.net/console/v1/ via curl in SKILL.md and seed_statsig.py.
Boundary markers: None explicitly defined for the interpolation of Statsig API data into prompt contexts.
Capability inventory: The skill has capabilities for file writing (.claude/plans/), network operations (curl), and extensive MCP tool execution.
Sanitization: Basic normalization is applied to flag names (lowercase/hyphenation), but no specific sanitization is observed for free-text fields like descriptions.

migrate-statsig