The Agent Skills Directory

[CREDENTIALS_UNSAFE]: The file tools/docsbot.py contains a hardcoded API key (DOCSBOT_API_KEY) for the docsbot.ai service. Hardcoding secrets in skill files is a significant risk as they are visible to users and in log files.\n- [OBFUSCATION]: The file room-builder/assets/local-usersig/lib-generate-test-usersig-es.min.js consists of minified JavaScript code. While it appears to be a library for generating user signatures, minified code hinders verification of its actual logic during static analysis.\n- [EXTERNAL_DOWNLOADS]: The runtime/package.json file includes a dependency on puppeteer. Running this code triggers the download of external browser binaries (Chromium) to the user's environment.\n- [COMMAND_EXECUTION]: Multiple scripts utilize the subprocess module to execute system commands: runtime/telemetry_collector.py and runtime/lib/platforms.py run development tools like adb and xcrun to capture logs, while tools/reporting.py executes node to process telemetry.\n- [INDIRECT_PROMPT_INJECTION]: The search and documentation retrieval tools (tools/search.py, tools/docs.py, tools/docsbot.py) ingest user-supplied queries and interpolate them into external search requests or KB scans. While telemetry redaction is present, the surface area for processing untrusted data could be used to influence agent behavior through retrieved snippets.

trtc