The Agent Skills Directory

[REMOTE_CODE_EXECUTION]: The skill includes instructions in a CI/CD workflow example that download installation scripts from external URLs (anchore GitHub) and pipe them directly into the shell (| sh). This bypasses local security checks and executes remote code without prior review.
[DYNAMIC_EXECUTION]: The skill recommends the global installation of the @cyclonedx/cdxgen package via npm install, which involves downloading and executing code from the NPM registry at runtime.
[INDIRECT_PROMPT_INJECTION]: The skill's primary function is to ingest and analyze external data—such as container images, source code directories, and package manifests—to generate metadata. This surface could be exploited if an attacker provides a malicious artifact designed to influence the agent's logic or the resulting output.
Ingestion points: Container image references (e.g., ghcr.io/acme/api), local source directories (dir:.), and SBOM files in SKILL.md.
Boundary markers: The instructions lack explicit delimiters or safety warnings to ignore instructions embedded within the metadata or files being processed.
Capability inventory: The skill utilizes several powerful CLI tools (syft, cdxgen, grype, cosign) capable of file system access, network operations, and command execution.
Sanitization: There is no evidence of input validation or sanitization for the image names or directory paths passed to the tools.
[COMMAND_EXECUTION]: The skill relies extensively on executing external CLI tools and shell commands to perform its tasks, which increases the potential impact if any inputs to these commands are compromised.

sbom-supply-chain