The Agent Skills Directory

[EXTERNAL_DOWNLOADS]: Fetches installation scripts from rclone's official domain.
Evidence: Downloads the rclone installation script via curl https://rclone.org/install.sh in both SKILL.md and scripts/check_setup.sh.
[COMMAND_EXECUTION]: Utilizes sudo to acquire elevated permissions for software installation and script execution.
Evidence: Commands such as sudo bash, sudo apt install, and sudo dnf install are suggested for setup operations.
[CREDENTIALS_UNSAFE]: Encourages passing sensitive authentication keys directly through command-line arguments.
Evidence: The configuration examples for Cloudflare R2 and AWS S3 in SKILL.md use rclone config create with access_key_id=YOUR_ACCESS_KEY and secret_access_key=YOUR_SECRET_KEY.
Secrets provided in this manner are often stored in shell history files (e.g., ~/.bash_history) and are visible to other users on the system via process monitoring tools.
[PROMPT_INJECTION]: The skill exhibits an attack surface for indirect prompt injection by processing untrusted metadata from remote storage providers.
Ingestion points: Remote contents and configurations are read using rclone ls, rclone lsd, and rclone listremotes in scripts/check_setup.sh and SKILL.md.
Boundary markers: No markers or explicit instructions are provided to the agent to ignore potentially malicious content in file names or remote names.
Capability inventory: The skill has extensive capabilities, including file synchronization, deletion, network requests, and system-level command execution via sudo.
Sanitization: There is no evidence of sanitization or escaping of data retrieved from remote sources before it is processed or displayed.

rclone