The Agent Skills Directory

[REMOTE_CODE_EXECUTION]: The skill's installation instructions in README.md recommend executing remote scripts directly from GitHub using curl -sL ... | bash for macOS/Linux and a download-then-execute pattern for Windows (install.bat). These methods execute unverified remote code without integrity checks, posing a significant risk of arbitrary code execution.
[EXTERNAL_DOWNLOADS]: The skill is designed to automate the retrieval and installation of additional AI agent skills (AGENTS.md files) from skills.sh and GitHub at runtime. This creates a supply chain risk by introducing executable instructions from external repositories into the agent's environment.
[COMMAND_EXECUTION]: The agent is granted extensive autonomous capabilities via the Bash tool, including installing global software packages (npm i -g), modifying environment settings (enabling experimental Agent Teams), and managing cloud deployments. This level of system access could be abused if the agent's logic is subverted.
[PROMPT_INJECTION]: The skill presents a large attack surface for indirect prompt injection. Multiple sub-agents are tasked with reading and analyzing the entire project source code (src/ directory), documentation, and help files. The absence of boundary markers or instructions to ignore embedded commands means that malicious content within the project files could manipulate the agent's behavior during the audit.
Ingestion points: Project source code (src/), README.md, package.json, .env files, and in-app help documentation.
Boundary markers: None present in the agent prompts to differentiate between data and instructions.
Capability inventory: Access to Bash, Write, Agent, Read, Grep, Glob, and WebSearch tools.
Sanitization: No sanitization or validation of the ingested file content is performed before processing.
[DATA_EXFILTRATION]: The security audit component is explicitly instructed to search for and analyze secrets, API keys, and credentials. While intended for auditing, the combination of file-read access and network-enabled tools (WebSearch, Bash) provides a potential vector for data exfiltration if the agent is targeted by an injection attack.
[COMMAND_EXECUTION]: The skill utilizes dynamic context injection (!command syntax) in SKILL.md to run shell commands automatically when the skill is loaded. While the currently used commands (e.g., pwd, git log) are benign, this feature represents a silent execution vector that runs before user interaction.

audit-my-app