The Agent Skills Directory

[COMMAND_EXECUTION]: The skill executes a local binary (pomodoro) using the Bash tool to manage work sessions. It passes user-provided task names as command-line arguments.
[DATA_EXFILTRATION]: There is no evidence of network activity or data exfiltration. Session data is stored locally in a SQLite database (pomodoro.db) within the skill's configuration directory.
[PROMPT_INJECTION]: The skill processes user-supplied task names which are passed to the shell. While this presents an indirect injection surface, the use of quotes in the instructions mitigates immediate risk. * Ingestion points: User-provided task descriptions provided during session start. * Boundary markers: Task arguments are enclosed in double quotes in command examples. * Capability inventory: Access to the Bash and Read tools to interact with the local binary and filesystem. * Sanitization: No explicit sanitization or filtering of the task string is mentioned in the instructions.

pomodoro