The Agent Skills Directory

[CREDENTIALS_UNSAFE] (HIGH): The file references/authentication.md contains realistic hardcoded API credentials including an accessKey (wBzMakF4Cpl7hAt0QtzqRZ3d), a secretKey (yV2ZqHyOmb8xqDe5kSxnyM6d3...), and a functional-looking JWT token. These do not use standard placeholder patterns (e.g., 'YOUR_API_KEY') and represent a high risk of credential exposure.
[DATA_EXFILTRATION] (HIGH): The scripts/document.py file includes commands cmd_upload and cmd_download that allow reading from and writing to arbitrary file paths provided by the user (or the agent). While these are functional requirements for a document management skill, they serve as powerful primitives for exfiltrating sensitive system files (e.g., SSH keys, environment files) if the agent is manipulated via prompt injection.
[INDIRECT_PROMPT_INJECTION] (LOW):
Ingestion points: The skill ingests untrusted data through document downloads in scripts/document.py and webhook delivery attempts/test events in scripts/webhook.py.
Boundary markers: Not present in the provided script logic; boundary handling is delegated to the missing utils.py module.
Capability inventory: The skill possesses capabilities for arbitrary file-system writes (cmd_download), network uploads (cmd_upload), and access to API credentials via scripts/auth.py.
Sanitization: There is no evidence of sanitization or safety filtering for the content of processed documents or webhook payloads.
[EXTERNAL_DOWNLOADS] (SAFE): Network operations are directed towards api.digisign.org and app.digisign.org, which are the legitimate service domains described in the documentation.

digisign