The Agent Skills Directory

[REMOTE_CODE_EXECUTION]: The skill instructs the agent to download and execute a remote shell script using the command: curl -fsSL https://raw.githubusercontent.com/holon-run/uxc/main/scripts/install.sh | bash. This pattern allows an external source to execute arbitrary code on the user's system without prior review.
[EXTERNAL_DOWNLOADS]: The skill fetches installation scripts and binaries from the holon-run GitHub organization, which is not a recognized trusted vendor or well-known service. This introduces a supply chain risk.
[COMMAND_EXECUTION]: The instructions require the agent to execute multiple shell commands, including managing daemons (uxc daemon), creating filesystem links (uxc link), and running binary verification scripts. While these are part of the intended functionality, they involve significant system state mutation.
[INDIRECT_PROMPT_INJECTION]: The skill exhibits an indirect prompt injection surface as it is designed to ingest and process data from external sources (MCP servers, OpenAPI, GraphQL, gRPC, etc.).
Ingestion points: Data enters the context via the uxc link command and subsequent calls to linked external hosts or stdio commands in SKILL.md.
Boundary markers: The skill suggests separate contract fields but lacks explicit delimiters for external data during execution.
Capability inventory: The agent has the capability to perform file writes ($UXC_ROOT/uxc.<binary-owner-skill>.manifest), network operations via uxc, and command execution through binary links.
Sanitization: The skill includes a policy to discard payloads like URLs, titles, and tokens unless explicitly requested, which serves as a partial mitigation.

uxc-facade