The Agent Skills Directory

[EXTERNAL_DOWNLOADS]: Communicates with official Asana API endpoints (app.asana.com) to perform project management tasks. As a well-known service, these network operations are considered standard behavior for this skill's purpose.
[COMMAND_EXECUTION]: Utilizes standard command-line tools like curl and jq for executing API requests and parsing JSON responses. Temporary files are used appropriately in /tmp for staging request payloads.
[DATA_EXFILTRATION]: Authentication is managed via the ASANA_TOKEN environment variable, which is the recommended method for secure credential handling in agent skills. No access to sensitive local files (e.g., SSH keys, AWS credentials) was detected.
[PROMPT_INJECTION]: The skill is susceptible to indirect prompt injection because it ingests untrusted data from external API responses (such as task names or project notes).
Ingestion points: API response data retrieved from app.asana.com via curl commands.
Boundary markers: Not present; the agent processes raw data from the API.
Capability inventory: Shell command execution via curl and jq as documented in SKILL.md.
Sanitization: No explicit sanitization or escaping of retrieved content is performed before processing.

asana