The Agent Skills Directory

[Indirect Prompt Injection] (LOW): The skill demonstrates a workflow that fetches data from an external API (Firefox CI) and pipes it through jq to extract identifiers which are then used as arguments for CLI commands.
Ingestion points: API call to firefox-ci-tc.services.mozilla.com in the 'Download Taskcluster worker logs' section.
Boundary markers: Absent; data is extracted and passed directly to the next command.
Capability inventory: Execution of paperctl and curl subprocesses.
Sanitization: No evidence of shell escaping or validation for the workerId string before it is passed to paperctl pull.
[Data Exposure & Exfiltration] (LOW): The skill interacts with sensitive credentials and configurations.
Sensitive file paths: Accesses ~/.config/paperctl/config.toml and the PAPERTRAIL_API_TOKEN environment variable.
Context: This is standard for log management tools and no exfiltration patterns were detected.
[Command Execution] (SAFE): The skill relies on the pre-installed paperctl CLI tool and standard utilities like curl and jq to perform its tasks. These operations are consistent with the skill's stated purpose.

papertrail