The Agent Skills Directory

[EXTERNAL_DOWNLOADS]: The skill invokes npx extract-zip, which dynamically fetches and executes the extract-zip package from the npm registry at runtime.- [COMMAND_EXECUTION]: Automatically runs pnpm install --no-frozen-lockfile if the extraction results in changes to package.json. This action can trigger arbitrary code execution via post-install scripts contained within the extracted zip file.- [COMMAND_EXECUTION]: Employs node -e to execute a JavaScript one-liner for decoding file content. While used here for base64 decoding, this pattern facilitates dynamic code execution.- [COMMAND_EXECUTION]: Provides instructions to modify pnpm-workspace.yaml to set allowBuilds to true. This action specifically bypasses environment security constraints intended to block potentially malicious build scripts.- [PROMPT_INJECTION]: The skill defines a workflow where untrusted data (zip archive contents) is extracted and then used to trigger high-privilege system operations (dependency installation) without a validation step or human-in-the-loop review of the extracted files.

unzip