The Agent Skills Directory

[COMMAND_EXECUTION]: The skill extensively uses curl to fetch data from a remote API and jq to parse and filter the resulting JSON. These tools are used as intended for data retrieval and processing.\n- [DYNAMIC_CONTEXT_INJECTION]: The SKILL.md file utilizes the !command syntax to check for the presence of curl and jq on the system when the skill is loaded. This is a benign diagnostic check.\n- [EXTERNAL_DOWNLOADS]: The skill fetches company data from https://yc-oss.github.io/api/. The data is in static JSON format and does not contain executable code.\n- [PRIVILEGE_ESCALATION]: The instructions in SKILL.md suggest using sudo apt-get install jq as a remediation step if the jq utility is missing from the system. This provides a path for the agent to request elevated privileges to install a dependency.\n- [INDIRECT_PROMPT_INJECTION]: The skill ingests data from an external, potentially untrusted source (yc-oss.github.io), which could contain malicious instructions embedded in company descriptions.\n
Ingestion points: JSON company profiles and one-liners fetched via curl.\n
Boundary markers: Absent; the agent is instructed to summarize the data without specific delimiters or warnings.\n
Capability inventory: The skill has network access via curl and data processing capabilities via jq.\n
Sanitization: None; the skill relies on the LLM to handle the data safely during summarization.

yc-reader