The Agent Skills Directory

[CREDENTIALS_UNSAFE]: The skill explicitly scans for and collects sensitive credentials and private keys from locations such as ~/.ssh/, .aws/, and .kube/, as well as environment variables in shell profiles like .zshrc and .bash_profile. Although the instructions specify asking the user for permission first, storing these secrets in an unencrypted JSON manifest file (~/migration-manifest.json) creates a risk of accidental exposure or credential theft if the file is shared or stored in insecure locations.
[REMOTE_CODE_EXECUTION]: The skill executes the official Homebrew installation script using a curl | bash pattern (/bin/bash -c "$(curl -fsSL https://raw.githubusercontent.com/Homebrew/install/HEAD/install.sh)"). This is a remote code execution pattern targeting a well-known service.
[COMMAND_EXECUTION]: During the restoration phase, the agent dynamically generates and executes shell commands based on the contents of the migration-manifest.json file. This includes installing packages via brew, npm, uv, pip, and go, as well as performing file synchronization using rsync and cp on system-level directories.
[DATA_EXFILTRATION]: The skill's primary function involves aggregating system-wide metadata, software inventories, and configuration files into a single manifest. The ability to read broad swaths of the file system and consolidate it into a portable format represents a significant data collection and potential exfiltration surface.
[EXTERNAL_DOWNLOADS]: The skill initiates multiple external downloads and installations from various package registries (including Homebrew, npm, PyPI, and Go) to replicate the software environment on the new system.
[INDIRECT_PROMPT_INJECTION]: The skill processes untrusted external data from the ~/migration-manifest.json file during the restore phase.
Ingestion points: Reads the manifest file from the home directory (SKILL.md).
Boundary markers: No explicit delimiters or instructions are used to prevent the agent from following directions potentially embedded within the manifest data.
Capability inventory: Executes shell commands (brew install, npm install), performs file writes, and modifies system services (launchctl load).
Sanitization: There is no evidence of sanitization or schema validation performed on the manifest content before it is interpolated into shell commands.

macos-migration