The Agent Skills Directory

[REMOTE_CODE_EXECUTION]: The skill's installation instructions include a command that downloads a script from a remote URL and pipes it directly into the bash shell.
Evidence: curl -sSL https://raw.githubusercontent.com/Dicklesworthstone/ultimate_bug_scanner/main/install.sh | bash
Risk: This method executes remote code from an unverified third-party source without any integrity verification or review, allowing the script to perform any action on the host system.
[EXTERNAL_DOWNLOADS]: The skill fetches content from an external GitHub repository that is not associated with a trusted organization or well-known service.
Source: https://raw.githubusercontent.com/Dicklesworthstone/ultimate_bug_scanner/main/install.sh
[COMMAND_EXECUTION]: The skill utilizes shell commands (curl, bash, ubs) to perform its primary functions, including tool installation and local file scanning.
[INDIRECT_PROMPT_INJECTION]: The skill is designed to ingest and process untrusted data (source code files) from the local environment.
Ingestion points: Files and directories processed by the ubs command (e.g., ubs src/, ubs file.ts).
Boundary markers: None identified in the provided instructions to separate untrusted file content from the agent's logic.
Capability inventory: The skill executes the ubs command which reads local filesystem data.
Sanitization: No sanitization or validation of the scanned file content is mentioned, which could lead to the agent being influenced by malicious instructions embedded in the code it is scanning.

ubs