The Agent Skills Directory

[Data Exposure & Exfiltration] (MEDIUM): The skill's primary function is to create public internet tunnels to local filesystem artifacts using ngrok. This creates a significant attack surface where local content is made accessible over the public internet. While the instructions advise scoping to specific artifacts, a misconfiguration or malicious intent could lead to the exposure of sensitive files like SSH keys, credentials, or environment files.
[Command Execution] (MEDIUM): The skill executes a local Python script scripts/ngrok_preview.py and potentially the ngrok binary via subprocess. The arguments for these commands, specifically the --source file paths and --title, are derived from task context which may be influenced by external or untrusted data.
[Unverifiable Dependencies & Remote Code Execution] (LOW): The skill requires the ngrok binary, directing users to download it from an external site (ngrok.com). While ngrok is a well-known service, it is not within the defined list of Trusted External Sources, and the skill relies on this external executable to function.
[Indirect Prompt Injection] (LOW): The skill is vulnerable to surface-level indirect injection if an attacker can influence the file paths passed to the --source argument.
Ingestion points: The --source argument in scripts/ngrok_preview.py accepts arbitrary file paths.
Boundary markers: None implemented in the command structure; reliance is placed on the agent's adherence to natural language instructions to "Collect only task artifacts".
Capability inventory: The skill uses ngrok to provide network access to local files and executes shell commands via python3 scripts.
Sanitization: There is no evidence of path sanitization or validation to prevent the inclusion of sensitive system files outside the intended task scope.

ngrok-preview