The Agent Skills Directory

[REMOTE_CODE_EXECUTION]: The primary function of the skill is to install and update skills from external Git repositories (GitHub, GitLab, Bitbucket, etc.) and local paths. These skills are then synchronized to directories where AI agents (such as Claude, Cursor, and Windsurf) read and execute them, creating a significant attack surface for third-party code execution.
[EXTERNAL_DOWNLOADS]: The skillshare hub add command allows fetching JSON indices from arbitrary user-provided URLs. Additionally, the install and update commands perform network operations to download content from remote Git hosts.
[COMMAND_EXECUTION]: The scripts/run.sh script executes a local binary named skillshare from the user's cache directory (~/.cache/skillshare/bin/) or the system PATH. The skill also performs extensive filesystem operations, including creating symlinks and file copies across multiple sensitive tool directories (e.g., ~/.claude/, ~/.ssh/-related paths are mentioned in context of audit).
[PROMPT_INJECTION]: The skill processes external SKILL.md files from remote sources, which makes it susceptible to indirect prompt injection. While the tool provides a built-in audit command to mitigate these risks, the inclusion of --skip-audit and --force flags allows the agent or an attacker to bypass these security controls entirely.
[DATA_EXFILTRATION]: The collect command allows the agent to pull local (non-symlinked) files from target directories back into a source directory. These files can then be synchronized to other targets or pushed to a remote repository via the push command, potentially leading to the accidental exposure of local configurations or sensitive instructions.

skillshare