The Agent Skills Directory

[REMOTE_CODE_EXECUTION]: The skill instructions in SKILL.md and references/commands.md explicitly direct the agent to download and execute shell scripts from external sources using the curl piped to bash pattern. This occurs for both the primary installer and the quick launchers setup scripts hosted on raw.githubusercontent.com. These sources are not from verified trusted organizations, posing a critical execution risk.
[EXTERNAL_DOWNLOADS]: Automated security scanners have identified the domain mole.fit, which is referenced multiple times as the official site for the utility's GUI counterpart, as a malicious or blacklisted URL. The presence of a blacklisted domain as a primary resource for the tool increases the overall risk profile of the skill.
[DATA_EXFILTRATION]: The skill enables access to commands like mo status --json and mo history --json, which collect and return sensitive system metadata. This includes detailed host information, hardware performance metrics, and a persistent log of all file system modifications and deletions performed on the machine.
[COMMAND_EXECUTION]: The provided scripts/mole.sh helper script acts as a shell wrapper that allows the agent to execute the mole binary with arbitrary arguments. While it contains basic subcommand validation, it lacks comprehensive argument sanitization, which could be exploited to manipulate binary behavior or perform unintended actions.
[PROMPT_INJECTION]: The skill is vulnerable to indirect prompt injection because it processes untrusted file system data (such as filenames and directory structures) and incorporates it into the agent's context without sanitization.
Ingestion points: Output from mo analyze, the clean-list.txt candidate file, and the operations log.
Boundary markers: Absent; raw file system metadata is interpolated directly.
Capability inventory: System-wide file deletion (mole_delete), shell command execution, and network access via curl.
Sanitization: Absent; the skill relies on the underlying tool for safety but does not filter the data presented to the agent.

mole