The Agent Skills Directory

[REMOTE_CODE_EXECUTION]: The skill provides instructions to install a CLI tool by downloading a script from a remote URL (https://cdn.crabnebula.app/install/cn) and piping it directly into the shell (| sh), allowing for the execution of unverified remote code.
[PRIVILEGE_ESCALATION]: The GitHub Actions workflow examples include the use of sudo apt-get install to install system dependencies, which requires administrative system privileges.
[DYNAMIC_EXECUTION]: The skill implements an auto-update mechanism using the downloadAndInstall() method from the Tauri updater plugin, which fetches and executes new binary code at runtime from a remote CDN.
[COMMAND_EXECUTION]: The implementation includes the use of the relaunch() command to programmatically restart the application process, which allows the application to control its own execution state.
[EXTERNAL_DOWNLOADS]: The skill depends on multiple third-party resources, including GitHub Actions (crabnebula-dev/cloud-release, tauri-apps/tauri-action), binary tools via Cargo (cn-cli), and various Node.js plugins (@tauri-apps/plugin-updater).
[INDIRECT_PROMPT_INJECTION]: The update process fetches metadata (version and release notes) from an external CDN and displays it in a UI dialog without demonstrating sanitization or boundary markers.
Ingestion points: The check() function in src/updater.ts fetches remote update metadata.
Boundary markers: None are present in the update dialog implementation (ask() call).
Capability inventory: The skill possesses capabilities for network requests, file writing (binary updates), and process execution (relaunching).
Sanitization: No explicit escaping or filtering is applied to the remote update.body content before it is processed.

using-crabnebula-cloud-with-tauri