The Agent Skills Directory

[REMOTE_CODE_EXECUTION]: The skill executes remote code from the vendor's infrastructure during environment setup and installation.
The .devcontainer/devcontainer.json file contains an onCreateCommand that downloads and executes a shell script from https://raw.githubusercontent.com/htlin222/dotfiles/main/start/codespace_prewarm.sh using curl | bash.
The scripts/oe-mcp.sh script clones the openevidence-mcp repository from GitHub (https://github.com/htlin222/openevidence-mcp.git) and invokes make all and make update, which executes commands defined in the external repository's Makefile.
[COMMAND_EXECUTION]: The skill uses a bash script (scripts/oe-mcp.sh) to perform management tasks such as repository cloning, directory creation, and building the MCP server and browser extension.
[INDIRECT_PROMPT_INJECTION]: The skill ingests and processes clinical data from the OpenEvidence API via MCP tools, creating a vulnerability surface where malicious instructions in the retrieved data could target the agent.
Ingestion points: Data enters the agent's context through tools like oe_article_get, oe_public_get, and oe_answers_search which return content from the OpenEvidence service.
Boundary markers: The skill's instructions do not include specific delimiters or "ignore instructions" warnings for the external clinical content processed by the agent.
Capability inventory: The skill has access to shell command execution (scripts/oe-mcp.sh), file system writes (via SQLite sync tools and make), and network communication (via the relay daemon).
Sanitization: No explicit sanitization or content validation steps are documented before interpolating the retrieved evidence into the agent's response.

openevidence