The Agent Skills Directory

[REMOTE_CODE_EXECUTION]: The skill provides instructions to install Atuin by downloading a script from https://setup.atuin.sh and piping it directly into a shell (curl ... | sh). This pattern, found in SKILL.md, references/sync-setup.md, and references/troubleshooting.md, represents a significant security risk as it executes remote code without prior verification.
[COMMAND_EXECUTION]: The documentation instructs the agent to configure shell integration using eval "$(atuin init [shell])". This executes dynamically generated code from the Atuin binary within the user's shell environment.
[PRIVILEGE_ESCALATION]: The skill includes commands that use sudo to move shell completion scripts into system-wide protected directories such as /usr/local/share/zsh/site-functions/ and /etc/bash_completion.d/.
[DATA_EXFILTRATION]: The core functionality of the skill involves synchronizing the user's shell history (which may contain sensitive information) to a remote server at https://api.atuin.sh. While the service uses encryption, it facilitates the systematic transmission of local activity data to an external endpoint.
[DYNAMIC_EXECUTION]: The skill uses eval to execute shell initialization scripts generated at runtime by the tool, which is a form of dynamic code execution.
[INDIRECT_PROMPT_INJECTION]: The skill is designed to ingest and search shell history. Because shell history is essentially untrusted data that can be influenced by external scripts or malicious command outputs, it creates a vector for indirect prompt injection where the agent might interpret history entries as instructions.
Ingestion points: atuin import auto and various search commands documented in SKILL.md and references/commands.md.
Boundary markers: No explicit boundary markers or instructions are provided to the agent to distinguish between history data and commands.
Capability inventory: Access to shell execution (eval), system-level file modification (sudo), and network operations for synchronization.
Sanitization: While a secrets_filter is mentioned for the synchronization process, there is no evidence of sanitization to protect the agent's logic from malicious content within the history data itself.

atuin