The Agent Skills Directory

[DATA_EXPOSURE_AND_EXFILTRATION]: The migration process is specifically designed to avoid exposing sensitive data. The merge_mcp_config.py script contains logic to detect and skip server definitions that include literal secrets, tokens, or passwords in their environment variables, headers, or command arguments. Additionally, it returns only redacted summaries and counts to the agent context.
[INDIRECT_PROMPT_INJECTION]: The skill possesses a surface for indirect injection as it processes local GUI configuration files. 1. Ingestion points: gui_settings_file_path and gui_mcp_config_file_path defined in SKILL.md. 2. Boundary markers: The instructions include explicit safety boundaries and warnings to treat these files as untrusted inputs. 3. Capability inventory: The skill utilizes Python scripts to read settings and merge MCP configurations into the user's CLI profile. 4. Sanitization: Strict sanitization is performed by inspect_shared_settings.py using schema validation and merge_mcp_config.py which redacts names and filters server definitions containing literal sensitive keys.
[DYNAMIC_EXECUTION]: Local file modifications are handled via secure Python scripts that implement atomic write operations using temporary files and enforce restricted user-only permissions (0o600). The scripts also perform symbolic link rejection and use cryptographic fingerprints to ensure file integrity between the dry-run and apply phases, preventing time-of-check to time-of-use (TOCTOU) vulnerabilities.

tui-migrate-setup