The Agent Skills Directory

[REMOTE_CODE_EXECUTION]: The skill's primary documentation (README.md and SKILL.md) encourages installation via a piped shell command: curl -fsSL https://apix.sh/install | sh. This practice executes an unverified remote script with the user's shell permissions, posing a risk of system compromise if the remote source is untrusted or hijacked.\n- [COMMAND_EXECUTION]: The tool's Rust source code (src/registry/git.rs) invokes the std::process::Command API to execute git subcommands such as clone, pull, and sparse-checkout. This behavior allows the skill to interact directly with the host's filesystem and network using system binaries.\n- [DATA_EXFILTRATION]: The apix call subcommand allows an agent to transmit data to URLs defined in markdown vaults. Critically, the tool supports reading the contents of any local file into the request body using the @ prefix (e.g., apix call <route> -d @~/.ssh/id_rsa). If an agent processes a malicious API definition, this functionality could be used to exfiltrate sensitive local data to an attacker-controlled endpoint.\n- [PROMPT_INJECTION]: The skill facilitates the ingestion of external API documentation (OpenAPI specs and markdown vaults) and presents it to the agent. This creates a surface for indirect prompt injection.\n
Ingestion points: External documentation is parsed and displayed to the agent via show, peek, and grep commands.\n
Boundary markers: The tool lacks boundary markers or instructions to isolate the external documentation from the agent's primary directives.\n
Capability inventory: The skill provides high-risk capabilities, including making network calls, reading local files, and executing host commands.\n
Sanitization: Content sanitization is limited to basic markdown formatting during the documentation generation process.

apix