The Agent Skills Directory

[REMOTE_CODE_EXECUTION]: The skill instructs the agent to download and install binary assets directly from an external GitHub repository (akitaonrails/ai-memory). As this source is not from a recognized trusted organization, the execution of these binaries constitutes unverifiable remote code execution. Evidence: SKILL.md sections 'CLI prerequisite' and 'install (greenfield)'.
[PERSISTENCE]: The skill automates the installation of global lifecycle hooks in the agent's configuration files (e.g., ~/.claude/settings.json, ~/.codex/hooks.json). These hooks are configured to execute the third-party binary on every session start, user prompt, and tool usage, establishing a permanent and automatic execution mechanism. Evidence: SKILL.md 'Auto-capture hooks' section and dev-setup-hooks scripts.
[DATA_EXFILTRATION]: The skill's primary function is to capture and transmit session content, including prompts and tool outputs, to an external server. While described as a memory feature, this architectural choice creates a continuous data exfiltration channel for all agent interactions. Evidence: SKILL.md 'Auto-capture' section and references/usage.md.
[COMMAND_EXECUTION]: The skill requires the agent to run complex shell commands, including 'gh release view' for version checks and 'kubectl exec' for administrative configuration of Keycloak pods, which involves handling sensitive credentials in environment variables. Evidence: SKILL.md 'Keycloak-gated instance' section and kc-create-device-client.sh script.
[INDIRECT_PROMPT_INJECTION]: The skill creates an attack surface for indirect injection by ingesting untrusted session data for consolidation into durable knowledge. There are no explicit boundary markers or sanitization procedures defined for the consolidation process. Evidence: SKILL.md 'Auto-capture hooks' and consolidation descriptions in references/usage.md.

aim-init