The Agent Skills Directory

[EXTERNAL_DOWNLOADS]: The installation script (scripts/install-ccboard.sh) and instructions (commands/install.md) fetch the official Rust toolchain installer from https://sh.rustup.rs.
[REMOTE_CODE_EXECUTION]: The skill executes the downloaded Rust installation script via a shell pipe (curl ... | sh). This is the standard, documented installation method for the Rust programming language and the source is a well-known service.
[COMMAND_EXECUTION]: The /ccboard-install command performs a global binary installation using cargo install ccboard --force. This involves downloading and compiling code from the crates.io package registry. The tool ccboard is a resource owned by the skill's author.
[DATA_EXFILTRATION]: The ccboard-web command launches a web interface that serves data from ~/.claude/, including claude_desktop_config.json. This configuration file frequently contains sensitive credentials such as API keys and personal access tokens for Model Context Protocol (MCP) servers. Serving these secrets over a network port, even if documented for localhost, creates a potential exposure risk if the interface is reachable by other users or devices on the same network.
[INDIRECT_PROMPT_INJECTION]: The dashboard processes and displays untrusted content from conversation history (JSONL files) and agent metadata files. This creates a surface where malicious instructions or deceptive content embedded in historical logs could influence the user or the dashboard's display logic.

ccboard