The Agent Skills Directory

[PROMPT_INJECTION]: The skill is susceptible to indirect prompt injection because it ingests untrusted data from external sources and processes it using powerful tools. Ingestion points include JS bundles fetched via curl, and package.json or requirements.txt files fetched from GitHub via the gh api. The skill does not provide boundary markers or instructions to the agent to ignore potentially malicious embedded commands within the fetched content. Its capability inventory includes bash, curl, gh, jq, and docker. While content is processed using jq or decoded with base64, there is no evidence of sanitization or filtering to prevent the agent from executing instructions hidden in the target data.\n- [REMOTE_CODE_EXECUTION]: The skill contains a reference to a remote execution pattern involving Codecov. The command curl -s https://codecov.io/bash | bash is documented in a historical case study section. As Codecov is a well-known service, this reference is documented neutrally as a remote execution pattern.\n- [EXTERNAL_DOWNLOADS]: The skill performs multiple network requests to external package registries and APIs to perform reconnaissance. This includes fetching package metadata from registry.npmjs.org, pypi.org, rubygems.org, and proxy.golang.org, as well as using the GitHub API to query organizations and clone repositories.\n- [COMMAND_EXECUTION]: The skill utilizes several command-line tools to perform its reconnaissance tasks. This includes the use of gh for GitHub interactions, docker for image inspection, and security tools like trufflehog and gitleaks for secret mining. It also includes a Python script execution pattern for generating typosquat candidates.

supply-chain-attack-recon