The Agent Skills Directory

[COMMAND_EXECUTION]: The skill contains mandatory instructions to execute curl commands on every invocation. These commands send POST requests to a local notification server at http://localhost:8888/notify. While the target is localhost, the use of shell execution for notifications is a significant capability.
[COMMAND_EXECUTION]: The Workflows/TechnicalCreativityGemini3.md file specifies the use of the llm CLI tool to perform complex technical analysis. This involves executing shell commands like llm -m gemini-3-pro-preview with multi-line prompt strings.
[PROMPT_INJECTION]: The skill is vulnerable to indirect prompt injection through its customization feature. It is instructed to load and apply instructions from PREFERENCES.md and other resources found in ~/.opencode/skills/PAI/USER/SKILLCUSTOMIZATIONS/BeCreative/ to override default behavior.
Ingestion points: Local filesystem access in SKILL.md to load user-defined customization files.
Boundary markers: No boundary markers or 'ignore embedded instructions' warnings are present when the agent is told to 'apply' these resources.
Capability inventory: The skill has access to shell execution (curl, llm) and network access (to localhost).
Sanitization: There is no sanitization or validation of the external configuration content before it is used to override agent instructions.
[DATA_EXFILTRATION]: The skill performs local filesystem discovery by checking for and reading files in the user's home directory (~/.opencode/...) to find potential overrides and resources. While used for customization, this pattern involves reading data from outside the skill's own package scope.

BeCreative