The Agent Skills Directory

[CREDENTIALS_UNSAFE]: Authentication credentials such as passwords and user accounts are passed as plaintext command-line arguments (e.g., --password, -u, -p), which can lead to exposure in command history or process monitoring logs.
[CREDENTIALS_UNSAFE]: The skill stores sensitive authentication tokens in the local ~/.kweaver/ directory.
[COMMAND_EXECUTION]: Broad command execution capabilities are provided through the kweaver CLI, allowing for extensive management of knowledge networks, agents, and data sources.
[DATA_EXFILTRATION]: The kweaver call and kweaver curl commands allow the agent to perform arbitrary HTTP requests to any URL, which could be used for data exfiltration.
[EXTERNAL_DOWNLOADS]: The skill downloads the @kweaver-ai/kweaver-sdk and playwright packages from official registries.
[PROMPT_INJECTION]: The skill is susceptible to indirect prompt injection because it ingests data from external sources like databases and CSV files. Ingestion points: Data retrieved via kweaver bkn object-type query, kweaver ds tables, and kweaver vega catalog resources (documented in SKILL.md and reference files). Boundary markers: No explicit delimiters or instructions to ignore embedded commands are present in the documentation. Capability inventory: The agent can execute any kweaver CLI command via Bash. Sanitization: There is no evidence of sanitization or validation of the data retrieved from external systems before it is processed by the agent.

kweaver-core