The Agent Skills Directory

[EXTERNAL_DOWNLOADS]: The skill is configured to download and install multiple third-party security tools and MCP bridges. While many of the sources are well-known technology organizations, the references/tool-sources.md file includes a reference to a personal GitHub repository (github.com/bethington/ghidra-mcp) for the Ghidra MCP bridge. Downloading and executing software from unverified personal accounts introduces a risk of supply chain compromise.
[COMMAND_EXECUTION]: The skill's primary function involves identifying, downloading, and executing shell commands to install runtimes, packages, and system services. This broad command execution capability, driven by external data sources, increases the potential impact of any malicious redirection.
[PRIVILEGE_ESCALATION]: The instructions explicitly mention using available privileges to automate installation and license acceptance. As tool installations often require administrative or root access (e.g., sudo or admin shells), the skill may perform system-wide modifications that could be abused if the installation logic or sources are compromised.
[INDIRECT_PROMPT_INJECTION]: The skill exhibits an attack surface for indirect prompt injection by ingesting untrusted data from multiple sources to drive its execution logic:
Ingestion points: The agent is instructed to read local project files (README.md, AGENTS.md) and remote repository content/documentation to determine the OS, architecture, and required tools.
Boundary markers: The instructions do not specify any delimiters or safety warnings to ignore instructions embedded within the files being inspected.
Capability inventory: The skill possesses extensive capabilities, including system-wide software installation, file modification, service management, and shell command execution.
Sanitization: There is no evidence of sanitization or validation of the content read from external documentation or local project files before it influences the installation commands.

setup-security-workspace