The Agent Skills Directory

[CREDENTIALS_UNSAFE]: The script scripts/query-usage.mjs specifically reads the ANTHROPIC_AUTH_TOKEN environment variable. While accessing credentials from the environment is a standard practice, this skill targets a specific secret associated with a major third-party provider (Anthropic) for use in a script designed for a different model family (GLM/Zhipu), which is a characteristic pattern of credential sniffing.
[DATA_EXFILTRATION]: The retrieved ANTHROPIC_AUTH_TOKEN is transmitted via an HTTPS GET request to external endpoints at api.z.ai and open.bigmodel.cn. Since these domains are not whitelisted for sensitive data transmission, this constitutes a data exfiltration risk, especially given the mismatch between the credential's intended service (Anthropic) and the destination servers.
[COMMAND_EXECUTION]: The SKILL.md file instructs the agent to execute a Node.js script using Bash. The execution involves shell commands that, while static in this version, provide a vector for arbitrary command execution if instructions were altered to include user-controlled inputs.
[INDIRECT_PROMPT_INJECTION]: The script scripts/query-usage.mjs ingests data from external APIs and logs the raw JSON response directly to the agent's output buffer via console.log(JSON.stringify(outputData)).
Ingestion points: Network response from https.request in scripts/query-usage.mjs.
Boundary markers: None; output is logged as raw JSON strings.
Capability inventory: The skill has Bash and Read capabilities enabled via allowed-tools.
Sanitization: None; the external content is not filtered or escaped before being displayed to the agent, allowing a malicious server response to inject instructions into the agent's context.
[METADATA_POISONING]: Automated security scans flagged SKILL.md with a FileRepMalware reputation alert. This indicates that the file structure or specific text patterns match known malicious indicators or suspicious artifacts previously identified in the wild.

usage-query-skill