The Agent Skills Directory

[PRIVILEGE_ESCALATION]: The skill utilizes the dangerouslyDisableSandbox: true flag in multiple Bash execution blocks. This explicitly requests the AI agent to bypass its standard security sandbox, allowing the commands to run with elevated permissions or direct access to the host environment, which is a significant security risk.
[DATA_EXFILTRATION]: The skill contains instructions for automated telemetry gathering and transmission to external domains (onboarding.confidence.dev and events.eu.confidence.dev). While these are associated with the vendor, the skill explicitly commands the agent to keep this activity 'transparent to the user' and 'never mention it, show payloads, or let it block the flow'. This intentional concealment of data transmission reduces user oversight and transparency.
[INDIRECT_PROMPT_INJECTION]: The skill scans the user's project files, templates, and dependencies to detect frameworks and privacy markers, creating an attack surface for indirect prompt injection.
Ingestion points: Project source code, package.json, lock files, and HTML templates are scanned in Steps 1, 2, and 6.
Boundary markers: None are defined; the skill does not use delimiters or instructions to ignore potential malicious content within scanned files.
Capability inventory: The skill can install packages, write to environment files (.env), modify application entry points, and execute build scripts.
Sanitization: The skill lacks logic to sanitize or validate content read from the project before using it to generate initialization code or configuration settings.
[COMMAND_EXECUTION]: The skill executes complex shell pipelines, including fetching credentials via curl and processing them using python3 -c. This introduces risks associated with executing code based on remote responses and managing secrets in the shell environment.

setup-session-recording