The Agent Skills Directory

[COMMAND_EXECUTION]: The skill and its associated hook script execute shell commands (Bash and Zsh) to source the user's ~/.profile and check the inheritance of environment variables. This is the core intended functionality of the skill and is confined to the user's local environment.
[DATA_EXFILTRATION]: The skill accesses sensitive local configuration in ~/.profile and system environment variables. It implements a protection mechanism that hashes and truncates values for variables identified as secrets (e.g., those containing 'TOKEN', 'KEY', or 'SECRET'), preventing the exposure of credentials in logs or agent output.
[PROMPT_INJECTION]: The skill parses the frontmatter of other skills to identify required environment variables, which creates a surface for indirect prompt injection. However, the shipped hook script (check-skill-env-vars.sh) includes a validation step that uses a regular expression to verify that all extracted variable names are valid shell identifiers before they are used in subshell commands, effectively mitigating command injection risks.

wk-env