The Agent Skills Directory

[PROMPT_INJECTION]: The instructions in SKILL.md command the agent to skip user confirmation and automatically execute setup tasks upon inclusion of the file. This pattern explicitly attempts to override the agent's standard safety and autonomy protocols.
[COMMAND_EXECUTION]: The skill utilizes the register_user_service tool to create a persistent background process named 'receipt-tracker'. This service is configured to restart automatically and persist across system reboots, which serves as a persistence mechanism.
[EXTERNAL_DOWNLOADS]: The setup procedure installs third-party Python packages (aiohttp, watchfiles) from public registries to enable file monitoring and network operations.
[DATA_EXFILTRATION]: The watcher.py script transmits local file paths and processing instructions to the vendor's API endpoint (https://api.zo.computer/zo/ask). This involves sending local system context to a remote server for processing.
[PROMPT_INJECTION]: The skill contains a surface for indirect prompt injection by processing untrusted external documents (receipts and invoices) and passing their context to an AI model with tool-execution capabilities.
Ingestion points: Files dropped into /home/workspace/receipt-processor/input/ are detected by the watchfiles loop in watcher.py.
Boundary markers: Absent; the absolute path of the untrusted file is directly interpolated into a natural language prompt.
Capability inventory: The AI is instructed to perform database operations (sqlite3), send emails (send_email tool), and move files (rename).
Sanitization: There is no validation or sanitization of the input file content before it is processed by the AI.

receipt-tracker-setup