The Agent Skills Directory

[REMOTE_CODE_EXECUTION]: The repository's installation guides recommend piping a remote shell script from GitHub directly into the bash or PowerShell interpreter (e.g., curl -fsSL ... | bash). While these resources originate from the author's repository, this pattern bypasses manual review of the executed code.
[COMMAND_EXECUTION]: Multiple Python scripts, including generate_report.py, lighthouse_runner.py, github_api.py, and repo_release_seo.py, utilize the subprocess module to run external binaries and internal scripts. This allows the skill to interact with system-level tools such as git, gh (GitHub CLI), and npx (Node Package Runner) using inputs derived from user requests.
[EXTERNAL_DOWNLOADS]: The installation process involves downloading release archives from GitHub and extracting them to the local environment. Additionally, scripts such as lighthouse_runner.py may trigger the retrieval of Node.js dependencies at runtime if they are not already installed.
[DATA_EXFILTRATION]: To perform its primary function, the skill fetches content from arbitrary external URLs. This functionality is mitigated by a shared security policy in scripts/lib/safe_http.py that validates resolved IP addresses to prevent Server-Side Request Forgery (SSRF) against internal or private networks.
[PROMPT_INJECTION]: The skill exhibits an indirect prompt injection surface as it ingests untrusted data from the web (via read_url_content and fetch_page.py) and incorporates it into the LLM's reasoning context. This context can subsequently influence the execution of high-capability scripts, although the severity is considered low due to existing LLM guardrails.

seo