The Agent Skills Directory

[REMOTE_CODE_EXECUTION]: The skill instructions include commands to download and immediately execute shell and PowerShell scripts from a remote repository. This "curl-pipe-bash" pattern is a critical security risk as it runs unverified code with the user's permissions.
Evidence:
curl --proto '=https' --tlsv1.2 -fsSL https://github.com/lexmount/moli/releases/latest/download/moli-installer.sh | sh (SKILL.md)
irm https://github.com/lexmount/moli/releases/latest/download/moli-installer.ps1 | iex (SKILL.md)
[COMMAND_EXECUTION]: The skill extensively uses the Bash tool to run the moli binary with various flags, including those that manipulate the local file system and network configuration.
Evidence: Examples in SKILL.md and references/commands.md show the use of the Bash tool for installation and tool execution.
[PROMPT_INJECTION]: The skill is susceptible to indirect prompt injection because it ingests untrusted data from external websites and processes it within the agent's context while maintaining powerful system capabilities.
Ingestion points: moli fetch output (Markdown, HTML, JSON, and semantic tree data) read from arbitrary URLs.
Boundary markers: The skill includes a 'Best Practice' recommendation for the agent to ignore in-page instructions, which serves as a mitigation but does not fully eliminate the risk.
Capability inventory: The skill has access to Bash, Read, Write, Edit, Glob, and Grep tools, allowing an injection to potentially trigger file modifications or command execution.
Sanitization: There is no evidence of automated sanitization or filtering of the retrieved web content before it is processed by the agent.

moli