The Agent Skills Directory

[REMOTE_CODE_EXECUTION]: The skill uses npx and uvx to execute remote code from the internet during both setup and runtime. Specifically, it executes packages like @korotovsky/slack-mcp-server, imessage-mcp, telegram-mcp, and discord-mcp which are maintained by individual third-party contributors. The use of the -y flag in npx bypasses user confirmation for package execution.
[EXTERNAL_DOWNLOADS]: The skill fetches software from various external sources, including ActivityWatch binaries, the uv tool from Astral, and extensions from the Chrome Web Store and Mozilla Add-ons. It also directs the agent to install a Workspace extension for Gemini from a third-party GitHub repository (gemini-cli-extensions/workspace).
[DATA_EXFILTRATION]: The skill processes highly sensitive personal information, including the content of private messages from Slack, iMessage, and Telegram, as well as full email bodies and calendar details. While the instructions claim local processing, this breadth of access by unverified third-party code represents a significant data exposure surface.
[COMMAND_EXECUTION]: There is extensive use of dynamic shell command generation (bash, curl, jq) to interact with local services, APIs, and the file system across multiple platforms (Claude Code, Codex, Gemini).
[PROMPT_INJECTION]: The skill is susceptible to indirect prompt injection because it ingests untrusted external data (emails and chat messages) and processes it as high-priority input for analysis without using explicit boundary markers or sanitization. An attacker could potentially manipulate the agent's audit findings or instructions by sending a malicious message or email to the user.

flowhunt