The Agent Skills Directory

[REMOTE_CODE_EXECUTION]: The installation section provides a command to pipe a remote script to the shell: curl -fsSL https://raw.githubusercontent.com/bjarneo/cliamp/HEAD/install.sh | sh. This pattern is highly insecure as it executes arbitrary code from a remote source with the user's privileges without any integrity checks. The source repository github.com/bjarneo is an unverified third-party account.
[COMMAND_EXECUTION]: The skill provides instructions for building and running code from unverified external repositories. Compiling from source using git clone https://github.com/bjarneo/cliamp.git and make install executes potentially untrusted build instructions. Installation of community plugins via git clone https://github.com/bjarneo/cliamp-plugin-soap-bubbles.git introduces unverified dynamic code into the application environment.
[EXTERNAL_DOWNLOADS]: The skill directs users to fetch and run software from unverified third-party GitHub repositories for both the main application and its extensions.
[REMOTE_CODE_EXECUTION]: The integrated Lua plugin system allows for dynamic execution of local scripts which can perform network operations via http_get, creating a surface for indirect prompt injection and data exfiltration if processing untrusted audio metadata. 1. Ingestion points: Track metadata (title, artist, album) processed in on_track_change in plugin.lua. 2. Boundary markers: Absent. 3. Capability inventory: Lua plugins can perform network requests (http_get) and log messages. 4. Sanitization: Absent.

cliamp-terminal-music-player