The Agent Skills Directory

[REMOTE_CODE_EXECUTION]: The bootstrap scripts download and execute external code at runtime.
scripts/bootstrap.sh downloads a script from https://raw.githubusercontent.com/ArchAstro/archdev/ via curl and pipes it directly to bash for installation.
scripts/bootstrap.ps1 downloads an installation script from the same GitHub repository to a temporary file and executes it using the PowerShell call operator (&).
These scripts target the skill author's repository and are used to install the core archdev binary required for the skill's functionality.
[DYNAMIC_EXECUTION]: The PowerShell bootstrap script dynamically creates and executes a script file.
Evidence in scripts/bootstrap.ps1: The script generates a temporary file path (installerPath) using a unique GUID, writes the downloaded content to it, and then executes the file.
[INDIRECT_PROMPT_INJECTION]: The skill is designed to process untrusted data from repositories which may contain malicious instructions meant to influence the agent's behavior.
Ingestion points: The agent reads project-level instructions, .archdev/agents/*.md definitions, and repository code during coding sessions (as described in SKILL.md and references/execution.md).
Boundary markers: There are no explicit boundary markers or warnings (e.g., "ignore embedded instructions") defined in the provided scripts to separate ingested data from agent instructions.
Capability inventory: The skill uses the archdev CLI to edit files, run model workflows, manage worktrees, and execute autonomous coding tasks.
Sanitization: No sanitization or validation logic is present to filter or escape instructions embedded within the files processed by the agent.
[CREDENTIALS_UNSAFE]: The skill instructions direct the agent to handle and inspect files containing sensitive authentication credentials.
Evidence in SKILL.md and references/providers.md: The agent is instructed to inspect and manage archdev.json and archdev.local.json, which are used to store provider subscriptions, OAuth profiles, and API keys.
While the documentation includes best-practice warnings against sharing these credentials, the skill's primary function involves accessing these sensitive credential stores.

agents