The Agent Skills Directory

[REMOTE_CODE_EXECUTION]: The documentation encourages users to install the software by piping remote scripts directly into a shell interpreter using bash <(curl ...) and PowerShell's iex. These scripts are hosted on cdn.link-ai.tech, which is not a recognized trusted domain. This pattern is dangerous as it allows for the execution of unverified and potentially changing code with user privileges.
[COMMAND_EXECUTION]: The skill documents the use of a bash tool and other terminal-based capabilities. These tools allow the agent to execute arbitrary shell commands on the host system, creating a significant attack surface if the agent is manipulated into running malicious commands.
[DATA_EXFILTRATION]: The skill provides tools for reading local files and performing network operations such as web_fetch and browser automation. This combination allows for the potential exfiltration of sensitive local data (such as API keys or configuration files) to external servers.
[EXTERNAL_DOWNLOADS]: The installation guide references multiple external files hosted at cdn.link-ai.tech, including shell scripts and Docker configuration files, which are downloaded and executed during setup.
[PROMPT_INJECTION]: Usage examples like the "GitHub Issue Reporter" show the agent fetching untrusted data from external APIs and using it directly in shell commands (bash) and file operations without sanitization. This establishes a clear surface for indirect prompt injection and command injection.
Ingestion points: web_fetch from the GitHub API in SKILL.md examples.
Boundary markers: None used in the documentation examples to isolate external data from instructions.
Capability inventory: bash, read, write, web_fetch, and browser tools described in SKILL.md.
Sanitization: No evidence of escaping or validation is provided in the examples that process external content.

cowagent-ai-assistant