The Agent Skills Directory

[REMOTE_CODE_EXECUTION]: The skill instructions and scripts perform remote script execution by piping the output of curl directly into a shell. This includes the project's own installer from the author's GitHub repository and third-party tools like the Beads issue tracker.
[EXTERNAL_DOWNLOADS]: Remote downloads occur during the installation process and within maintenance scripts. Resources are fetched from GitHub repositories and the official Rust toolchain service.
[COMMAND_EXECUTION]: Python scripts within the repository, specifically scripts/check_scanner_safety.py and scripts/perf_baseline.py, use the subprocess module to execute shell commands. Static analysis indicates that one of these scripts executes commands or data fetched from a remote JSON endpoint.
[PRIVILEGE_ESCALATION]: The skill's documentation provides instructions for system-wide installation that requires the use of sudo to execute the remote installer script with administrative privileges.
[INDIRECT_PROMPT_INJECTION]: The skill provides file-scanning capabilities that process various project files, including Dockerfiles, shell scripts, and CI configurations. This ingestion of untrusted data creates a potential surface for indirect prompt injection attacks, although the skill implements normalization and keyword-gating mitigations.
[PERSISTENCE]: The dcg setup command offers to add diagnostic checks to user shell initialization files such as ~/.bashrc and ~/.zshrc, which execute at the start of every shell session.

dcg