The Agent Skills Directory

[REMOTE_CODE_EXECUTION]: The skill provides installation commands that download scripts from the internet and execute them immediately using bash or PowerShell's Invoke-Expression (iex). This allows for unverified code to run in the user's environment.
Evidence: curl -fsSL https://polylane.com/install.sh | bash and irm https://polylane.com/install.ps1 | iex in SKILL.md.
[DYNAMIC_EXECUTION]: The tool includes a command for running raw JavaScript strings, enabling the execution of arbitrary logic.
Evidence: polylane tools code 'async () => { return await tools.findNodes({ query: "api" }); }' in SKILL.md.
[INDIRECT_PROMPT_INJECTION]: The skill consumes untrusted data that could contain malicious instructions designed to manipulate the agent. 1. Ingestion points: The agent is instructed to read service logs (polylane service logs), search codebases (polylane repo grep), and view issue reports (polylane issue show). 2. Boundary markers: The skill does not provide any instructions or delimiters to help the agent distinguish between data and potentially malicious embedded instructions. 3. Capability inventory: The agent has broad capabilities including shell command execution, automation triggering, and tool execution. 4. Sanitization: There are no instructions or mechanisms mentioned for sanitizing or validating the content retrieved from external sources.
[COMMAND_EXECUTION]: The skill is primarily designed to facilitate the execution of a wide range of shell commands through the polylane CLI.
[EXTERNAL_DOWNLOADS]: The skill references and downloads resources from external domains, including installation scripts and MCP server configurations.

polylane-cli