The Agent Skills Directory

[REMOTE_CODE_EXECUTION]: The skill downloads a compiled binary (jta) from an external GitHub repository (github.com/hikanner/jta) and executes it. This allows for the execution of arbitrary code provided by the repository owner on the local system.
[PRIVILEGE_ESCALATION]: The installation process described in SKILL.md and automated in scripts/install.sh uses sudo mv to move the downloaded binary into /usr/local/bin/. This requires administrative credentials and grants the external binary elevated status on the host system.
[COMMAND_EXECUTION]: The skill utilizes the Bash tool to perform environment detection, download files from the internet, modify file permissions, and execute system commands.
[EXTERNAL_DOWNLOADS]: The skill uses curl -L to fetch multiple platform-specific binaries from github.com/hikanner/jta, which is not a recognized trusted source.
[INDIRECT_PROMPT_INJECTION]: The skill processes user-supplied JSON i18n files through an "Agentic reflection" mechanism. This creates a surface for indirect prompt injection where instructions embedded in the JSON files could influence or hijack the AI's translation and reflection logic.
[CREDENTIALS_UNSAFE]: The skill explicitly checks for and uses sensitive environment variables (OPENAI_API_KEY, ANTHROPIC_API_KEY, GEMINI_API_KEY) and passes provider information to the third-party binary, potentially exposing these credentials to an unverified tool.

jta