The Agent Skills Directory

[REMOTE_CODE_EXECUTION]: The skill's deploy.md file instructs the agent to download and execute a shell script from https://vibehost.com/install.sh. This 'curl | sh' pattern is a high-risk vector for arbitrary code execution if the remote server or communication is compromised.
[EXTERNAL_DOWNLOADS]: Automated scanners identified blacklisted URLs within the skill's source code: https://halloween-vibehost-official.vibehost.space (used as a default landing page in build.mjs) and https://Hollow-x.vibehost.space/farm/bob?y (used as an example in find-village.mjs). Additionally, the skill installs the playwright-core package from the NPM registry at runtime as specified in SKILL.md.
[COMMAND_EXECUTION]: Multiple scripts, including find-village.mjs and the instructions in deploy.md, invoke the vibehost CLI tool to perform operations on user workspaces and applications. This provides the agent with the capability to modify the user's environment on the VibeHost platform.
[DATA_EXFILTRATION]: The village-rules.mjs script uses the fetch API to retrieve content from user-provided URLs without validation. This behavior creates a Server-Side Request Forgery (SSRF) risk, which could be exploited to scan internal network services or leak agent request metadata (such as the IP address and user-agent) to an external server.

vibehost-haunted-farm