The Agent Skills Directory

[CREDENTIALS_UNSAFE]: The auth command in scripts/familysearch.py allows passing a username and password via CLI flags (-u, -p). This practice is insecure as it can expose sensitive credentials in the system's process list or shell history. The script does offer a secure interactive prompt as the default method.
[COMMAND_EXECUTION]: The _search_via_curl function executes the system curl binary using subprocess.run. While the use of an argument list prevents shell injection, executing external binaries creates a dependency on the underlying system's environment and security.
[EXTERNAL_DOWNLOADS]: The skill fetches data and artifacts from familysearch.org and ident.familysearch.org. It also recommends the installation of the getmyancestors package. These sources are well-known and reputable services for family history research.
[PROMPT_INJECTION]: The KNOWN_BUGS.md file contains instructions specifically for the AI agent to update the table upon encountering errors. This is a functional meta-instruction that guides agent behavior based on tool output.
[INDIRECT_PROMPT_INJECTION]: The skill processes genealogical data, memories, and sources retrieved from an external API.
Ingestion points: Data enters the system through API responses from FamilySearch via httpx and curl calls.
Boundary markers: No explicit delimiters or instructions are used to separate user data from the agent's instructions.
Capability inventory: The script can write files to the local filesystem and execute the curl command.
Sanitization: The script uses standard URL encoding for API parameters but does not perform secondary sanitization of the content returned from the API before it is processed by the agent.

familysearch