The Agent Skills Directory

[CREDENTIALS_UNSAFE]: The skill documentation includes a hardcoded API token (andromeda25) in the Authorization: Bearer header for all API request examples. This sensitive information is exposed directly within the skill's logic.- [COMMAND_EXECUTION]: The skill instructs the agent to use curl to perform various HTTP operations (POST, GET, PATCH, DELETE). These commands are used to modify remote state on the Andromeda Galaxy page.- [EXTERNAL_DOWNLOADS]: The skill facilitates communication with the external domain https://www.mishabuloichyk.com. While this appears to be the author's own domain for data storage, hardcoded credentials for such services are a significant vulnerability.- [PROMPT_INJECTION]: The skill ingests data from the /api/andromeda endpoint which could potentially contain untrusted content. There are no explicit boundary markers or sanitization steps documented to handle malicious instructions embedded in the API responses.

andromeda-messages