The Agent Skills Directory

[PERSISTENCE]: The skill instructions direct the agent to modify global configuration files, specifically ~/.codex/AGENTS.md and ~/.claude/CLAUDE.md. These modifications inject persistent instructions that force the agent to read and follow the password skill's methods before any authentication or credential retrieval task in future sessions.
[COMMAND_EXECUTION]: The skill extensively employs shell commands to manage system secrets and configuration. This includes using the macOS /usr/bin/security utility to interact with the login Keychain, the op (1Password) CLI to retrieve vault items, and npx for skill installation.
[CREDENTIALS_UNSAFE]: The core purpose of the skill is the automated handling and retrieval of highly sensitive credentials. It facilitates the storage of a 1Password service account token in the macOS login Keychain to allow the agent to access passwords, TOTP seeds, and recovery codes without manual human approval.
[INDIRECT_PROMPT_INJECTION]: The skill presents a large attack surface for indirect prompt injection as it is designed to ingest and process untrusted data from external sources during authentication workflows.
Ingestion points: The agent reads data from web browser UIs, mailbox content, and SMS connectors to find verification codes and login prompts.
Boundary markers: No specific delimiters or instructions to ignore embedded commands in the external data are specified in the provided files.
Capability inventory: The agent can execute shell commands via op and security, and has the ability to interact with and fill forms in the browser.
Sanitization: While the instructions advise catching subprocess errors to prevent secrets from appearing in logs, there is no mention of sanitizing or escaping the data retrieved from external sources before it is processed by the agent.
[REMOTE_CODE_EXECUTION]: The setup guide recommends the use of npx skills add udecode/dotai, which involves fetching and executing code from a remote repository to install the skill and its components.

passwords