The Agent Skills Directory

[REMOTE_CODE_EXECUTION]: The skill instructs the agent to download and execute an external npm package named skills using npx --yes. This package is not a recognized industry-standard tool, and its execution provides a pathway for remote code execution. Additionally, the skill's primary purpose is to install executable content from arbitrary, user-provided Git repositories into global agent directories.
[COMMAND_EXECUTION]: The workflow involves heavy use of shell commands (including git clone, npx, and python3) that incorporate user-supplied strings such as repository URLs, branch names, and commit IDs. If these inputs are not perfectly sanitized by the agent's execution environment, they present a high risk of shell command injection.
[PERSISTENCE]: By design, this skill installs third-party code into global directories (e.g., ~/.agents/skills, ~/.claude/skills) used by multiple AI agent platforms. This establishes persistence, as the installed skills will be loaded and executed across different sessions and across different agent applications (Claude Code, Cursor, GitHub Copilot, etc.).
[INDIRECT_PROMPT_INJECTION]: As an installer of remote content, the skill is highly susceptible to indirect prompt injection. A malicious repository could include instructions within its SKILL.md or configuration files designed to deceive the agent during the "Source Review" phase or to bypass security constraints during the installation process.
[PRIVILEGE_ESCALATION]: The skill targets "global" installation paths. While it does not explicitly use sudo, the act of modifying global agent configurations and shared directories expands the agent's reach beyond a single project scope, increasing the potential impact of any malicious skill installed through this process.

install-skill-pack