The Agent Skills Directory

[EXTERNAL_DOWNLOADS]: The script scripts/wiki-init.ts clones the repository https://github.com/tobi/qmd.git into the user's local directory (~/.local/share/essential-skills/qmd/checkouts/qmd) when initialized.
[REMOTE_CODE_EXECUTION]: After cloning the external QMD repository, the skill automatically executes bun install and bun run build to compile the tool. This constitutes the execution of unverified code from an external source during the skill's setup process.
[COMMAND_EXECUTION]: The skill installs persistent hooks into the agent's configuration files (e.g., .claude/settings.json, .codex/hooks.json, and opencode.json). These hooks execute shell scripts located in .claude/hooks/, .codex/hooks/, and .opencode/hooks/ during session startup and after every tool use.
[COMMAND_EXECUTION]: The generated OpenCode plugin (.opencode/plugins/wiki-guardrails.js) uses Bun.spawn to execute bash scripts on the host machine. It pipes tool input and response data into these scripts via stdin, which creates an execution path dependent on potentially untrusted tool output.
[PROMPT_INJECTION]: The skill contains an indirect prompt injection surface. The installed hooks and plugins (such as wiki-policy-check.sh.tmpl and WikiGuardrails) ingest and process data from tool inputs and responses to determine whether to block actions or suggest wiki updates. This processing of untrusted data from the agent's conversation or environment could be exploited to influence script behavior.
[COMMAND_EXECUTION]: The scripts/wiki-init.ts script performs dynamic string replacement (patching) on the source code of the downloaded QMD tool before building it, modifying core logic such as database transactions and MCP server initialization at runtime.

wiki-init