The Agent Skills Directory

[REMOTE_CODE_EXECUTION]: The Aerodrome plugin (plugins/aerodrome.md) executes remote code by downloading and running the sugar CLI directly from a third-party GitHub repository (velodrome-finance/sugar-sdk) using uvx.
[REMOTE_CODE_EXECUTION]: Multiple plugins including Morpho and OpenSea instruct the agent to execute remote code by installing and running third-party CLI packages (@morpho-org/cli, @opensea/cli) via npx.
[COMMAND_EXECUTION]: The approval-mode.md reference instructs the agent to automatically execute shell commands (open, xdg-open, start) to open URLs in the user's browser, which can be exploited for command injection if URL parameters are manipulated.
[DYNAMIC_EXECUTION]: The Bitrefill plugin (plugins/bitrefill.md) includes a full standalone JavaScript implementation of the Keccak256 algorithm and SIWE message building logic to be executed within the agent's shell environment.
[EXTERNAL_DOWNLOADS]: The Balancer plugin (plugins/balancer.md) requires the installation of external Node.js dependencies (@balancer/sdk, viem) and the execution of custom scripts to prepare transaction data.
[INDIRECT_PROMPT_INJECTION]: Token discovery plugins (Bankr, Clawnch, Flaunch) ingest data from external HTTP APIs containing unfiltered user-supplied strings (names, descriptions, handles), creating a surface for indirect prompt injection when this data is rendered in the agent's context.
[DATA_EXPOSURE]: The Bitrefill and Virtuals plugins handle sensitive data including session JWTs, redemption codes, and email contents, which may be exposed in chat logs if not handled carefully.
[PROMPT_INJECTION]: The tone.md reference attempts to override agent behavior by enforcing specific language constraints ("Never use the word web3") and interaction styles based on perceived user sophistication.

base-mcp