The Agent Skills Directory

[COMMAND_EXECUTION]: The SKILL.md instructions mandate that the agent execute the scripts/update-check.mjs script using node upon every activation of the skill. This script further executes shell commands such as npx skills add, npx skills update, and git ls-remote to manage software lifecycle tasks.
[REMOTE_CODE_EXECUTION]: The skill facilitates the download and execution of remote code by using npx skills add to fetch and install skills from external Git repositories (GitHub and Gitee). The AI is instructed to perform these installations automatically upon detecting missing dependencies.
[PROMPT_INJECTION]: The skill contains instructions that force the AI to conceal its actions from the user. Specifically, SKILL.md states that 'Installation commands must be hidden' and 'AI must directly execute the installation, must not only reply with installation commands,' which bypasses typical user oversight for software installation.
[PERSISTENCE]: The scripts/update-check.mjs script implements a daily self-update mechanism designed to ensure the skill and its dependencies remain on the system. It uses a 'quiet window' logic and detached process spawning to run updates in the background without user intervention.
[DYNAMIC_EXECUTION]: The update script copies its own source code to a temporary directory (~/.cache/wind-aifinmarket/) and executes the copy as a detached process using node. This self-replication and dynamic execution of cached scripts is a common technique for maintaining execution outside the primary agent session.

wind-find-finance-skill