The Agent Skills Directory

[COMMAND_EXECUTION]: The skill preamble executes several shell commands to determine the environment, check for updates, and verify local configuration files in ~/.rmbc-skills/ and /tmp/.
[DATA_EXFILTRATION]: The skill automatically executes a local binary rmbc-analytics during the preamble to log usage data, including the skill name and the currently active product name. While it includes an opt-out mechanism later, the initial telemetry call occurs before the user is prompted for consent.
[COMMAND_EXECUTION]: A command injection vulnerability exists in the 'Completion Protocol'. The agent is instructed to take freeform text from the user ('What product or offer are you writing for?') and insert it directly into a shell command: /bin/rmbc-workspace active "<user's answer>". A malicious or accidental input containing shell metacharacters (e.g., ;, &, |) could lead to arbitrary command execution on the host system.
[EXTERNAL_DOWNLOADS]: The skill uses the open command to navigate to a YouTube URL. This is a well-known service and is used here for instructional video content.

lander-copy