The Agent Skills Directory

[REMOTE_CODE_EXECUTION]: The skill's catalog (CATALOG.md) contains recommendations that involve downloading and executing shell scripts directly from unverified GitHub accounts, such as git clone ... && bash install.sh for the 'talk-normal' and 'motionmaxxing' resources.
[REMOTE_CODE_EXECUTION]: Recommends installing a Model Context Protocol (MCP) server from an external domain (sloppatterns.com) using the npx add-mcp command.
[COMMAND_EXECUTION]: The maintenance script scripts/check-catalog.mjs uses execFileSync to execute shell commands like git and npm based on strings parsed from the catalog file.
[INDIRECT_PROMPT_INJECTION]: The skill uses scripts/detect.mjs to ingest untrusted project data (file contents and directory structures), which is then used to select tool recommendations. This creates a surface where a malicious repository could influence the agent's output.
[INDIRECT_PROMPT_INJECTION]: Ingestion points: scripts/detect.mjs reads file names, dependency lists, and file contents up to 512KB from the current repository.
[INDIRECT_PROMPT_INJECTION]: Boundary markers: None implemented to prevent the agent from obeying instructions found within scanned project files.
[INDIRECT_PROMPT_INJECTION]: Capability inventory: The skill can generate and present shell commands and installation lines for user execution.
[INDIRECT_PROMPT_INJECTION]: Sanitization: Project content is not sanitized or escaped before influencing recommendation selection.
[REMOTE_CODE_EXECUTION]: Recommends a manual installation process for the 'architecture-diagram-generator' that requires downloading a ZIP file from an unverified GitHub source and extracting it into the agent's local skills directory (~/.claude/skills/).

anti-slop-skill-picker