The Agent Skills Directory

[REMOTE_CODE_EXECUTION]: The script scripts/ensure-daily-skill-update.mjs executes npx -y skills@latest, which downloads and runs the latest version of a package from the public npm registry without version pinning or hash verification. This creates a significant risk of remote code execution through supply chain attacks or registry poisoning.
[COMMAND_EXECUTION]: The skill relies on shell command execution for its core lifecycle, including the use of node to run internal management scripts and git for remote repository operations. These commands are executed automatically during daily updates and knowledge synchronization.
[EXTERNAL_DOWNLOADS]: The skill connects to the public npm registry for updates and to a specific GitHub repository (https://github.com/15810879921-coder/oneos-pm-skills.git) to fetch and synchronize development knowledge, establishing persistent external data flows.
[DATA_EXFILTRATION]: The automated synchronization mechanism (references/github-sync.md) instructs the agent to commit and push local knowledge files to a remote repository. This capability could be abused to exfiltrate sensitive codebase information, project structure, or accidental secrets if the agent is tricked into including them in its 'retrospective' records.
[INDIRECT_PROMPT_INJECTION]: The skill is configured for implicit invocation (agents/openai.yaml) and uses 'Active Recognition' logic to trigger its behaviors based on the semantic content of natural language or workspace activity. This allows an attacker to potentially trigger high-privilege actions, such as remote updates or repository pushes, by embedding deceptive 'development-like' text in files processed by the agent.
[CREDENTIALS_UNSAFE]: The skill's knowledge base (DB-C-006) provides instructions for the agent to access and use Alibaba Cloud AccessKeys stored in the operating system's secure credential storage. While it advises against hardcoding, it encourages the AI agent to perform high-privilege credential retrieval and usage in unattended tasks, increasing the attack surface for credential theft if the agent's environment is compromised.

development-brain