The Agent Skills Directory

[COMMAND_EXECUTION]: Step 3b employs dynamic code generation by inserting user-supplied text (token and user ID) into a Node.js script template using single quotes. This approach is susceptible to code injection; if a user provides an input containing a single quote, they can break out of the string literal and execute arbitrary JavaScript on the host system.
[COMMAND_EXECUTION]: The skill utilizes multiple bash scripts to perform administrative tasks such as reading and writing JSON configuration files, checking the status of a local worker via API calls to 127.0.0.1, and managing legacy process IDs. These scripts are integral to the skill's function but represent an active use of shell capabilities.
[SAFE]: The skill implements security best practices for secret management, including the use of restricted file permissions (chmod 600) and heredocs to prevent sensitive tokens from appearing in system process lists (argv).

cloud-sync