The Agent Skills Directory

[REMOTE_CODE_EXECUTION]: The skill quick start and installation instructions promote downloading and executing a script from an external, unverified source (https://raw.githubusercontent.com/colbymchenry/codegraph/main/install.sh) by piping it directly to the system shell. This practice allows for arbitrary code execution from a third-party GitHub repository.
[COMMAND_EXECUTION]: The skill requires the agent to run the codegraph CLI tool and an MCP server. These tools perform extensive file system operations, such as creating a .codegraph/ directory and managing a local SQLite database within the project.
[EXTERNAL_DOWNLOADS]: The skill relies on external resources, including shell scripts and NPM packages (@colbymchenry/codegraph), that originate from repositories and registries not associated with the skill's author or established trusted vendors.
[PROMPT_INJECTION]: The skill exhibits a high surface for indirect prompt injection attacks: 1) Ingestion points: The tool indexes and reads the entire project's source code. 2) Boundary markers: There are no instructions to the agent to treat code content as untrusted or to use delimiters to separate data from instructions. 3) Capability inventory: The skill has the capability to execute local commands and modify agent configurations (~/.claude.json). 4) Sanitization: There is no validation or sanitization of the ingested code content. The risk is amplified by the instruction to 'trust the returned results' and 'never verify' them using other tools, which could lead the agent to follow instructions maliciously embedded in code comments.

codegraph