The Agent Skills Directory

[CREDENTIALS_UNSAFE]: The skill reads the .env file at /home/ubuntu/projects/fellowship-dev/claude-buddy/.env to retrieve the QUEST_TOKEN. Accessing secret files is a high-risk activity for an automated agent.\n- [DATA_EXFILTRATION]: The skill reads the content of report files and transmits them via a curl POST request. Although targeted at 127.0.0.1, this pattern of secret retrieval followed by network transmission is a characteristic of data exfiltration.\n- [COMMAND_EXECUTION]: The skill uses python3 -c to generate JSON payloads while interpolating shell variables like $REPORT_TITLE directly into the script string. This creates a potential command injection vulnerability if the variables contain malicious payloads.

write-report