The Agent Skills Directory

[REMOTE_CODE_EXECUTION]: The skill uses npx -y to execute the godpowers@7 package. This command automatically downloads and runs code from the npm registry without requiring a confirmation prompt, which can be used to execute arbitrary code if the package is malicious or compromised.
[EXTERNAL_DOWNLOADS]: The skill relies on an external package (godpowers) from the npm registry. This package does not belong to a recognized trusted organization or well-known service, and its source code is not provided with the skill.
[INDIRECT_PROMPT_INJECTION]: The skill processes the output from the godpowers command and instructs the agent to relay this information. This creates a surface for indirect prompt injection where malicious content in the command output could influence the agent's behavior. * Ingestion points: The output of npx -y godpowers@7 status is ingested into the agent's context (SKILL.md). * Boundary markers: The instructions lack specific delimiters or instructions to ignore embedded commands within the tool output. * Capability inventory: The skill uses npx for command execution and package management. * Sanitization: There is no evidence of sanitization or filtering applied to the external tool's output before it is processed by the agent.

god-status