The Agent Skills Directory

[COMMAND_EXECUTION]: The skill instructs the agent to execute shell commands using unquoted variables (e.g., bunx dmv-agent register --name $ARGUMENTS). This pattern is vulnerable to command injection if the input contains shell metacharacters like semicolons or pipes. While the skill provides validation rules for the agent name, the use of unquoted interpolation in the command template is a security anti-pattern.
[EXTERNAL_DOWNLOADS]: The skill uses npx and bunx to download and execute code from the npm registry. It references both a scoped package (@agentcommunity/dmv-agent) and an unscoped package (dmv-agent). While the scoped package aligns with the skill author, the use of the unscoped name introduces a potential risk of dependency confusion or typosquatting if that name is not controlled by the same vendor.

dmv