The Agent Skills Directory

[CREDENTIALS_UNSAFE]: The documentation in references/local-runtime.md provides a code example for integrating OpenAI directly in the browser. It demonstrates using process.env.NEXT_PUBLIC_OPENAI_API_KEY with dangerouslyAllowBrowser: true. In modern web frameworks like Next.js, environment variables prefixed with NEXT_PUBLIC_ are automatically included in the client-side JavaScript bundle, meaning the API key is publicly accessible to any user who visits the site.
[DATA_EXFILTRATION]: The skill documents multiple pathways for sensitive data to leave the local environment, including sending conversation history to /api/chat, uploading files to the assistant-ui Cloud service, and transmitting voice data to providers such as ElevenLabs and LiveKit.
[COMMAND_EXECUTION]: The framework supports the execution of tool-call message parts as described in references/types.md. While intended for legitimate functionality, this mechanism allows the agent to execute code or operations based on potentially untrusted model output, which could be abused if the agent's instructions are manipulated.
[PROMPT_INJECTION]: The skill architecture presents a surface for indirect prompt injection. Ingestion points: External data enters through AttachmentAdapter file contents and ChatModelAdapter model responses. Boundary markers: The provided documentation examples do not demonstrate the use of delimiters or specific instructions to ignore embedded commands in untrusted data. Capability inventory: The runtime possesses capabilities to append/edit messages and execute tool-call actions. Sanitization: No explicit sanitization or filtering of external attachment content is documented in the adapter implementation examples.

runtime