The Agent Skills Directory

[COMMAND_EXECUTION]: The skill provides instructions for the agent to execute shell commands using the arkcli binary. This involves authentication, status checks, and API key configuration. Specifically, it guides the agent on how to use the --code flag with a user-supplied authentication string (e.g., arkcli auth login --no-browser --code <授权码>) during the SSO flow.
[INDIRECT_PROMPT_INJECTION]: A vulnerability surface is identified where user-supplied data (the Base64 authentication code) is directly interpolated into a shell command argument. This pattern depends on the agent platform's ability to sanitize input to prevent command injection.
Ingestion points: Authentication codes provided by the user in response to the SSO browser flow, as described in references/arkcli-auth-login.md.
Boundary markers: No specific delimiters or sanitization instructions are provided within the skill for handling the user-provided code.
Capability inventory: The skill utilizes shell command execution to interact with the arkcli tool across multiple scripts and instructions.
Sanitization: There is no evidence of explicit sanitization or validation of the external content before it is passed to the shell command.

arkcli-auth