The Agent Skills Directory

[EXTERNAL_DOWNLOADS]: The skill configuration specifies the automated installation of the Node.js package @anygen/cli within the metadata frontmatter section. This package name mimics the vendor identity anygenio but deviates from its recognized naming patterns, introducing a supply chain typosquatting risk.
[REMOTE_CODE_EXECUTION]: The instructions guide the agent to perform operations such as anygen skill install, which triggers the execution of remote or external packages. Running commands from a typosquatted CLI tool can result in arbitrary code execution.
[COMMAND_EXECUTION]: The skill details shell operations including anygen auth login --api-key and environment variable exports that execute commands using a potentially untrusted system binary.

anygen-slide