The Agent Skills Directory

[REMOTE_CODE_EXECUTION]: The script scripts/install-js.sh downloads and executes the Bun installation script from its official website (https://bun.sh/install) via a pipe to bash when the runtime is missing.\n- [COMMAND_EXECUTION]: The skill uses sudo in scripts/install-system.sh to install system packages, which grants the agent elevated privileges on the host system.\n- [COMMAND_EXECUTION]: There is a risk of shell command injection in the installation scripts. User-provided package names are interpolated into shell commands within double quotes, allowing for command substitution if the input contains patterns like $(...).\n- [COMMAND_EXECUTION]: The scripts/setup-env.sh script unsets platform environment variables such as CLAUDECODE, which are often used for environment identification or constraint enforcement.\n- [EXTERNAL_DOWNLOADS]: The skill performs network operations to download the Bun installer and packages from various public registries.\n- [PROMPT_INJECTION]: The skill has a surface for indirect prompt injection.\n
Ingestion points: Package names provided during the workflow described in SKILL.md.\n
Boundary markers: None; external input is not delimited from system instructions.\n
Capability inventory: Ability to execute shell commands and install software using pip, bun, and sudo with apt/brew/dnf.\n
Sanitization: None; inputs are passed directly to shell commands without validation.

install-dependency