The Agent Skills Directory

[CREDENTIALS_UNSAFE]: The script contains logic to read session cookies from the Linear desktop application database located at ~/Library/Application Support/Linear/Cookies using a Python subprocess. This is a form of local credential harvesting to facilitate downloads from auth-gated URLs.
[COMMAND_EXECUTION]: The script uses source "$HOME/.bash_profile" to acquire API keys if they are not already set in the environment. Sourcing arbitrary user shell profiles can execute unintended commands if the profiles have been tampered with.
[EXTERNAL_DOWNLOADS]: The skill downloads content from several external sources including uploads.linear.app, github.com (user attachments), and screencastify.com. While GitHub and Linear are well-known services, the script performs these downloads using authenticated headers gathered from the local system (cookies and tokens).
[DATA_EXFILTRATION]: Authenticated session data (Linear cookies, GitHub tokens) and local video files are sent to Google's Gemini API (generativelanguage.googleapis.com) for processing. While this is the core function of the skill, it involves sending potentially sensitive internal information to a third-party AI provider.
[DYNAMIC_EXECUTION]: The script generates and executes Python code at runtime using heredocs (`python3
<<'PY'`) to process SQLite databases and rewrite HLS video playlists. This is used for complex data manipulation that is difficult in pure Bash.
[PRIVILEGE_ESCALATION]: The script attempts to access the Linear application's private data directory on macOS. While it does not use sudo, it bypasses standard application sandboxing by reading the cookie database directly from the filesystem.

video-transcripts