The Agent Skills Directory

[REMOTE_CODE_EXECUTION]: The skill provides a 'One-Liner Install' command (curl -fsSL https://raw.githubusercontent.com/rohitg00/awesome-claude-code-toolkit/main/setup/install.sh | bash) that downloads and executes code directly from an unverified external source. This is a high-risk pattern as it bypasses local review.
[COMMAND_EXECUTION]: The toolkit establishes persistence and automated execution through several mechanisms:
Creates and modifies Git hooks (.git/hooks/pre-commit) to run scripts like bouncer and brooks-lint during development workflows.
Configures and runs lifecycle hooks in ~/.claude/hooks/ (e.g., pre-approve.js, post-task.js) which are Node.js scripts executed by the agent environment.
Instructs the user to perform system-level changes such as chmod +x on various scripts to enable their execution.
[EXTERNAL_DOWNLOADS]: The skill references and installs numerous third-party dependencies from untrusted repositories and package registries:
Multiple git clone operations from various individual GitHub accounts (e.g., emaarco/agento-patronum).
npx and npm installations for tools from unverified authors, including ccusage, bouncer, and claude-scaffold.
[PROMPT_INJECTION]: The toolkit presents an indirect prompt injection surface through its core functionality:
Ingestion points: Tools like ccpm read data from external GitHub issues, and bouncer audits local source files that may contain attacker-controlled content.
Boundary markers: No explicit boundary markers or instructions to ignore embedded commands are present in the skill.
Capability inventory: The skill has significant capabilities, including file system writes (writing config.json and hooks), network requests via npx tools, and the ability to execute shell commands through the hook system.
Sanitization: There is no evidence of sanitization or validation performed on the external content ingested from issues or source files before it is processed by the agent.

awesome-claude-code-toolkit