The Agent Skills Directory

[REMOTE_CODE_EXECUTION] (CRITICAL): Piped remote script execution detected from an untrusted source.
Evidence: curl -sSL https://canifi.com/skills/perplexity/install.sh | bash in SKILL.md.
Evidence: curl -sSL https://canifi.com/install.sh | bash in SKILL.md.
Impact: This pattern allows for arbitrary code execution with the user's current shell privileges without any prior verification of the script content.
[CREDENTIALS_UNSAFE] (HIGH): The skill instructs users to provide and store sensitive cleartext credentials.
Evidence: Documentation requests SERVICE_EMAIL and SERVICE_PASSWORD in SKILL.md.
Risk: Requesting and storing passwords directly in an unvetted environment is a major security risk that can lead to credential theft.
[EXTERNAL_DOWNLOADS] (HIGH): Downloads and installation instructions refer to an untrusted domain.
Source: canifi.com is not a recognized trusted source or organization.
[COMMAND_EXECUTION] (MEDIUM): The installation process involves direct shell command execution on the host system.
Impact: This expands the attack surface, allowing potential attackers to gain control over the local environment via the remote scripts.

perplexity