The Agent Skills Directory

[COMMAND_EXECUTION]: The skill is designed to run a complex synchronization script (scripts/sync) that has broad authority to modify the local system, including replacing live file paths, installing or removing machine-local tools, and performing destructive Git operations.
[DYNAMIC_EXECUTION]: The path to the execution script is computed at runtime using shell commands (ls, sort, tail) targeting the plugin cache directory. This dynamic resolution introduces a risk where the execution path could be redirected if the cache structure is tampered with.
[DATA_EXFILTRATION]: The skill supports pushing the machine's configuration to external repositories (--repo-url) and reaching out to other hosts in the user's fleet via SSH (--push-machines). It also handles secrets via a dedicated flag (--mcp-secrets-file), which are then processed by external helpers.
[PERSISTENCE]: The skill instructions explicitly encourage the agent to offer to schedule the synchronization task using the user's existing system scheduler, ensuring its continued operation on the host.
[INDIRECT_PROMPT_INJECTION]: The skill reconciles state based on data found in local configuration directories and remote repositories, creating a surface where malicious configuration data could influence the agent's actions during the synchronization process.
Ingestion points: Local directories ~/.agents, ~/.claude, ~/.codex, and ~/.config, along with remote Git repositories specified by the user or agent.
Boundary markers: None; the skill does not define specific delimiters or instructions to ignore embedded commands within the configuration data.
Capability inventory: Execution of shell scripts, system-wide file replacement, installation and removal of software tools, and network communication via Git and SSH.
Sanitization: No evidence of data sanitization or integrity verification for the ingested configuration files before they are used to drive system changes.

sync