The Agent Skills Directory

[REMOTE_CODE_EXECUTION]: The skill explicitly directs the agent to download a script from a remote server and pipe it directly into a shell interpreter.
Evidence: curl -fsSL https://www.lazyweb.com/install.sh | bash in SKILL.md.
This pattern bypasses all security checks and allows for immediate, unverified code execution on the host system.
[COMMAND_EXECUTION]: The skill requires the Bash tool and instructs the agent to run complex shell commands during the setup process.
Evidence: The allowed-tools section includes Bash, and the "First Run" section contains shell execution instructions.
[EXTERNAL_DOWNLOADS]: The skill performs network requests to fetch data that is then incorporated into the agent's context.
Evidence: Instructions to fetch https://www.lazyweb.com/api/mcp/welcome-message.
Evidence: Mentions of external design resources at https://styles.refero.design and https://reactbits.dev.
[PROMPT_INJECTION]: The skill is vulnerable to indirect prompt injection as it ingests and displays content from an untrusted external API.
Ingestion points: https://www.lazyweb.com/api/mcp/welcome-message in SKILL.md.
Boundary markers: None present in the instructions to prevent the agent from obeying instructions embedded in the fetched message.
Capability inventory: The agent has access to Bash, Read, Write, and WebFetch tools, which could be abused if the welcome message contains malicious commands.
Sanitization: No evidence of sanitization or validation of the remote content before it is processed by the agent.

lazyweb