The Agent Skills Directory

[DATA_EXFILTRATION]: The skill handles sensitive long-lived access tokens used for Home Assistant authentication.
Evidence: Both SKILL.md and scripts/ha_client.py retrieve and use HA_LONG_LIVED_TOKEN from environment variables and shell profiles to populate Authorization headers for network requests.
[COMMAND_EXECUTION]: The skill documentation encourages modification of shell profiles and utilizes shell sourcing commands.
Evidence: SKILL.md includes instructions to source ~/.zshrc and suggests adding multiple aliases and environment variables to the ~/.zshrc file for persistent access.
[PROMPT_INJECTION]: The skill documents an interface for Home Assistant template rendering, which creates a surface for indirect prompt injection or server-side template manipulation.
Ingestion points: The skill processes user-provided data or sensor values which may then be interpolated into API calls.
Boundary markers: None. There are no delimiters or warnings to ignore instructions within processed data.
Capability inventory: The skill can perform arbitrary HTTP requests to Home Assistant via scripts/ha_client.py (specifically call_service) and curl examples.
Sanitization: No sanitization or escaping is performed on data used to construct requests to the /api/template endpoint as documented in references/api_endpoints.md.

ha-rest-api