The Agent Skills Directory

[COMMAND_EXECUTION]: The preflight.py utility module defines a run function that executes shell commands using subprocess.run(shell=True). This function is used in smb_connect.py to perform mounting operations (mount_smbfs, net use) and to list server shares (smbutil). These commands are constructed by interpolating user-provided strings (usernames, passwords, and share names) without adequate shell sanitization, posing a risk of command injection.
[CREDENTIALS_UNSAFE]: The skill saves SMB server credentials, including usernames and cleartext passwords, to a local JSON file at ~/.vk-cowork/smb-config.json. Although the script attempts to secure this file using chmod 0o600, the storage of passwords in cleartext on the filesystem is a significant security risk.
[EXTERNAL_DOWNLOADS]: In preflight.py, the skill may trigger the installation of system software (Xcode Command Line Tools) on macOS via xcode-select --install if required utilities are not present.
[COMMAND_EXECUTION]: The smb_connect.py script programmatically modifies the local configuration file for the Clash Verge proxy (clash-verge.yaml) and sends requests to its API via a Unix socket (/tmp/verge/verge-mihomo.sock). While intended to fix DNS resolution issues, this represents direct manipulation of third-party application settings.

smb-file-browser