The Agent Skills Directory

[DATA_EXPOSURE]: The skill accesses sensitive vehicle location data.
In scripts/tesla.py, the cmd_location function retrieves latitude and longitude from the vehicle's drive state and displays it to the user.
[DATA_EXPOSURE]: The skill stores sensitive authentication tokens in a local file.
Both SKILL.md and scripts/tesla.py document the use of ~/.tesla_cache.json to store refresh tokens, which provides persistent access to the Tesla account.
[INDIRECT_PROMPT_INJECTION]: The skill processes untrusted vehicle names from the Tesla API, which serves as an injection surface.
Ingestion points: Vehicle names (display_name) are ingested in scripts/tesla.py via the tesla.vehicle_list() method.
Boundary markers: None are present to distinguish between vehicle data and agent instructions.
Capability inventory: The skill has significant physical capabilities including locking/unlocking the vehicle, honking the horn, and controlling climate systems via vehicle.command().
Sanitization: There is no sanitization of the display_name string before it is used in logic or displayed to the agent/user.

tesla