The Agent Skills Directory

[REMOTE_CODE_EXECUTION]: Found in SKILL.md at line 21, the command curl -fsSL https://cli.inference.sh | sh downloads a script from a remote server and executes it directly through the shell. This pattern is a critical security vulnerability as it permits arbitrary code execution without auditing the remote script.- [COMMAND_EXECUTION]: The skill provides templates to establish persistence on the host machine. It instructs the user to modify the crontab using crontab -e and provides multiple examples of scheduled tasks for recurring execution (SKILL.md, lines 188-200).- [DATA_EXFILTRATION]: The monitored_workflow.sh template (SKILL.md, lines 269-282) describes a mechanism to capture command strings and captured error output into a variable, which is then sent to an external webhook (https://your-webhook.com/alert) via a POST request. This is a potential channel for exfiltrating sensitive execution data.- [DATA_EXFILTRATION]: The data_processing.sh script (SKILL.md, lines 364-377) reads local files and interpolates their contents into a prompt for an external AI provider. Ingestion point: $(cat $file) at line 375. Boundary markers: Absent. Capability inventory: Filesystem access, command execution, and network transmission. Sanitization: Absent.- [REMOTE_CODE_EXECUTION]: In the "Related Skills" section (SKILL.md, lines 393-402), the skill promotes the installation of external code by suggesting the use of npx skills add to fetch and integrate additional skills from the inference-sh repository.- [PROMPT_INJECTION]: The workflow for data processing (SKILL.md, lines 364-377) is vulnerable to indirect prompt injection because it reads raw local file data directly into a prompt template without using delimiters or sanitization. This allows malicious instructions within the files to potentially override the agent's behavior.- [PROMPT_INJECTION]: There is a potential for deceptive metadata. While the skill author is listed as aiskillstore, the internal report and source URLs attribute the content to inference-sh, which may mislead users about the origin and accountability of the skill code.

ai-automation-workflows