The Agent Skills Directory

[COMMAND_EXECUTION]: The skill provides instructions for using the bash step type within workflows, which allows for the execution of arbitrary shell commands. It includes a {{q ...}} helper and shell-quoting pipes to mitigate command injection, but the capability itself is highly privileged.
[DYNAMIC_EXECUTION]: The workflow system supports executing Node.js modules (code.module) with full access to the Node.js API surface, as well as sandboxed inline JavaScript execution (code.source).
[EXTERNAL_DOWNLOADS]: The one mem feature triggers an automatic download of Postgres binaries (~52MB) via a bundled embedded-postgres plugin during first-time initialization.
[DATA_EXFILTRATION]: The workflow engine includes native file-read and file-write step types. These allow the agent to read sensitive local files and potentially exfiltrate them by chaining the output to API action steps (actions execute) targeting 3rd-party services.
[INDIRECT_PROMPT_INJECTION]: The skill is designed to ingest and process untrusted data from external sources such as Gmail, Slack, and Stripe via sync profiles and webhook relays.
Ingestion points: API responses from 3rd-party platforms, synced data stored in local memory, and incoming webhook payloads.
Boundary markers: The CLI uses an --agent flag to enforce structured JSON output, and template-based interpolation for data handling.
Capability inventory: The tool possesses broad capabilities including shell execution, Node.js execution, filesystem I/O, and network access to hundreds of service APIs.
Sanitization: The tool provides robust sanitization features including pipe-based escaping (| shell, | json, | url, | md, | html) to handle user-controlled data safely within templates.

one