The Agent Skills Directory

[COMMAND_EXECUTION]: The skill executes shell commands to install external packages using the npx skills add command. It explicitly instructs the agent to include the --yes flag to bypass user confirmation prompts during installation, particularly in automated or non-interactive environments.
[EXTERNAL_DOWNLOADS]: The skill maps user tasks to various GitHub repositories and URLs for downloading code, including sources outside the author's direct control, such as the GainForest/hyperindex repository.
[REMOTE_CODE_EXECUTION]: By automating the installation and execution of external skills from remote repositories without mandatory human review, the skill introduces a risk of remote code execution if the source repositories are compromised or contain malicious instructions.
[PROMPT_INJECTION]: The skill follows a 'meta-skill' pattern where it dynamically reads and follows instructions from an externally fetched SKILL.md file. This creates a surface for indirect prompt injection where the agent's behavior is directed by content fetched at runtime from external sources.
[DATA_EXPOSURE]: The installation workflow involves searching the user's entire home directory ($HOME) for specific file paths to locate installed skills, which grants the agent broad visibility into the user's file system structure.

hypercerts