The Agent Skills Directory

[REMOTE_CODE_EXECUTION]: The tutorial in references/claude-mem-litellm.md instructs the agent to install the Bun runtime using the command curl -fsSL https://bun.sh/install | bash, which is a high-risk remote code execution pattern.
[COMMAND_EXECUTION]: The skill generates and executes local scripts to modify system state. Specifically:
references/gemini-sidebar-fix.md creates and runs a Python script (fix_gemini_mac.py) to modify Chrome's Local State configuration file.
references/claude-mem-litellm.md uses sed to perform binary/code patching on the worker-service.cjs file of the claude-mem plugin, replacing hardcoded URLs.
The Windows version of the Gemini fix requires running PowerShell as an Administrator to modify sensitive application data.
[PERSISTENCE_MECHANISMS]: The references/claude-mem-litellm.md file instructs the agent to create a launchd plist file (com.claude-mem.litellm.plist) and load it via launchctl to ensure the litellm proxy runs persistently in the background and restarts automatically.
[CREDENTIALS_UNSAFE]: Multiple tutorials (Zhipu GLM, Claude-mem) instruct the user to provide API keys which are then stored in plaintext configuration files like ~/.claude/settings.json and ~/.claude-mem/settings.json.
[PROMPT_INJECTION]: The file references/claude-mem-litellm.md contains a 'Execution Flow' section explicitly labeled 'for AI assistant to read' (给 AI 助手读). This section contains meta-instructions that dictate how the agent should process the tutorial steps, including when to auto-execute commands versus pausing for user input.
[INDIRECT_PROMPT_INJECTION]: The skill processes untrusted markdown content from its references/ directory which contains instructions for the agent to execute shell commands and modify files.
Ingestion points: Files located in references/ are read based on user keywords.
Boundary markers: None identified; instructions in reference files are treated as direct tutorial steps for the agent to follow.
Capability inventory: The agent is expected to perform shell command execution (bash/PowerShell), script generation (Python/Bash), file system writes, and service management.
Sanitization: No sanitization or validation of the reference file content is performed before execution.
[DYNAMIC_EXECUTION]: The skill heavily relies on generating and executing scripts at runtime using heredocs (cat << 'EOF' > ...) to accomplish configuration tasks that are difficult to achieve through simple commands.

laohan-jiaocheng