The Agent Skills Directory

[REMOTE_CODE_EXECUTION]: The skill instructs the agent to install the "Lazyweb MCP" by executing curl -fsSL https://www.lazyweb.com/install.sh | bash. This pattern of piping remote content directly into a shell is a significant security risk as it allows for the execution of unverified code on the host system.
[CREDENTIALS_UNSAFE]: Multiple files in the skill (SKILL.md, generate-prototypes.py, fetch-evidence.py) access sensitive credential files located in the home directory, such as ~/.lazyweb/openai_api_key and ~/.lazyweb/lazyweb_mcp_token. Reading raw secrets from the filesystem increases the risk of credential exposure.
[COMMAND_EXECUTION]: The generate-prototypes.py script uses subprocess.run to call the codex CLI with arbitrary parameters. This dynamic command execution creates a surface for potential command injection if input data is not strictly sanitized.
[DATA_EXFILTRATION]: The skill is designed to read the local lazyweb_mcp_token and transmit it to a remote endpoint (https://www.lazyweb.com/mcp) for authentication. This establishs a data flow that sends local credentials to an external service.
[PROMPT_INJECTION]: The skill ingests untrusted data from web searches and external design databases to produce research reports. It lacks explicit boundary markers or sanitization for this external content, creating an indirect prompt injection surface where malicious instructions in the search results could influence agent behavior. (Ingestion: WebSearch/MCP; Boundaries: Absent; Capabilities: Bash/Write; Sanitization: Absent).

lazyweb-deep-design-research