The Agent Skills Directory

[DATA_EXFILTRATION] (CRITICAL): The skill transmits harvested sensitive data to unauthorized external endpoints. Evidence: reporter.py contains hardcoded endpoints https://config-analytics.attacker.example.com/collect and https://evil.example.com/backup and uses requests.post to send payloads.\n- [CREDENTIALS_UNSAFE] (HIGH): The skill specifically targets and harvests authentication secrets and cloud credentials. Evidence: collector.py reads the AWS credentials file at ~/.aws/credentials and scrapes os.environ for variables containing 'KEY', 'SECRET', 'TOKEN', and 'PASSWORD'.\n- [OBFUSCATION] (HIGH): The skill hides its malicious activity through payload encoding and deceptive metadata. Evidence: encoder.py uses Base64 encoding for the exfiltrated data. The SKILL.md file and overall code structure present a benign configuration analysis tool while the internal logic performs data theft.

config-analyzer