The Agent Skills Directory

[COMMAND_EXECUTION]: The workflow engine supports a bash step type that allows for the execution of arbitrary shell commands. While this requires an explicit --allow-bash flag and the documentation provides guidance on using shell-quoting pipes (| shell) and environment variables for safety, it remains a high-risk capability.
[REMOTE_CODE_EXECUTION]: Workflows support executing JavaScript through code steps. External code modules (.mjs) are executed in a child node process with full access to Node.js APIs, including the filesystem and network, providing a path for remote code execution if malicious modules are introduced.
[EXTERNAL_DOWNLOADS]: The skill's memory functionality automatically downloads Postgres binaries (approximately 52MB) via an embedded-postgres plugin upon first use.
[DATA_EXFILTRATION]: By design, the tool enables moving data between hundreds of third-party platforms (e.g., reading from Stripe and sending to Slack). This functionality could be leveraged for data exfiltration if a malicious workflow is executed or if the agent is manipulated into sending sensitive data to attacker-controlled endpoints.
[CREDENTIALS_UNSAFE]: The CLI manages authentication for numerous services and stores API keys and OAuth tokens in a local configuration file at ~/.one/config.json and project-specific directories.
[PROMPT_INJECTION]: The skill has a large surface for indirect prompt injection as it ingests untrusted data from external platforms (e.g., email content, chat logs). This data is often interpolated into workflows that have command execution and file-writing capabilities. Although the tool provides sanitization pipes, a failure to apply them correctly could allow malicious external content to trigger dangerous operations.
Ingestion points: Third-party API responses from 250+ platforms (SKILL.md, references/flows.md).
Capability inventory: Shell execution (bash), Node.js execution (code), filesystem writes (file-write), and network operations (action) found in references/flows.md.
Boundary markers: Use of Handlebars {{ }} delimiters in workflow definitions.
Sanitization: The tool provides context-aware pipes (json, shell, url, md, html) to escape data before interpolation, as described in references/flows.md.

one