The Agent Skills Directory

[REMOTE_CODE_EXECUTION]: The skill utilizes the $skill-oracle subroutine to discover and execute additional skills from ClawHub, an external repository of unknown provenance, which could lead to arbitrary code execution if the source is compromised.
[EXTERNAL_DOWNLOADS]: The skill regularly fetches documentation and executable subroutines from external sources such as ClawHub and Context7 MCP without integrity verification.
[COMMAND_EXECUTION]: The agent is instructed to run various shell commands including git status, ls, and npm scripts (lint, build, db:push) as part of its automated task completion workflow.
[DATA_EXFILTRATION]: Instructions in the references directory direct the agent to check for the presence and content of sensitive files including .env.local and .vercel/ directories, which could lead to the exposure of credentials.
[PROMPT_INJECTION]: The skill processes untrusted data from original user requests, local phase plans, and external documentation via Context7 MCP, creating an indirect prompt injection surface that lacks clear boundary markers or sanitization.
[COMMAND_EXECUTION]: Through the $skill-creator companion functionality, the agent is empowered to dynamically update its own instructions or generate new skills, introducing a risk of persistent malicious behavior if the agent's reasoning is subverted.

terminus-maximus