The Agent Skills Directory

[DATA_EXFILTRATION]: The Python script scripts/send_dayapp_push.py transmits task summaries and a user-provided deviceid to the external service api.day.app. While this is the intended purpose, it involves sending agent context to a third-party API.
[COMMAND_EXECUTION]: The script scripts/send_dayapp_push.py uses subprocess.check_output to run the ps command to identify whether the agent environment is Claude or Codex.
[PROMPT_INJECTION]: The skill is susceptible to indirect prompt injection (Category 8) as it aggregates current task context into notification payloads.
Ingestion points: Summarized task names and summaries are derived from the current agent conversation and passed to the execution script in SKILL.md.
Boundary markers: No delimiters or safety instructions are used when passing task data to the notification script.
Capability inventory: The skill uses urllib.request.urlopen for network communication and subprocess.check_output for system command execution in scripts/send_dayapp_push.py.
Sanitization: The strip_sensitive function in scripts/send_dayapp_push.py employs regular expressions to redact potential secrets (tokens, passwords) and URLs from the task text before transmission.

dayapp-mobile-push