The Agent Skills Directory

[REMOTE_CODE_EXECUTION]: The documentation provides installation commands that download and execute shell scripts directly from the internet.
Evidence found in SKILL.md and references/installation.md: curl -sfL https://direnv.net/install.sh | bash.
The source_url and fetchurl standard library functions described in references/stdlib-functions.md allow for downloading and sourcing remote scripts at runtime, though they include mechanisms for hash verification.
[COMMAND_EXECUTION]: The skill instructs users to set up shell hooks using eval, which is the standard method for direnv integration but involves executing dynamically generated shell code.
Evidence in SKILL.md: eval "$(direnv hook zsh)" and eval "$(direnv hook bash)".
Usage of sudo for package manager installations is documented in references/installation.md.
[DYNAMIC_EXECUTION]: The documentation includes examples of custom extensions that use eval to execute output from external commands.
Evidence in SKILL.md: The use_aws_secrets example uses eval on the output of aws secretsmanager and jq to export variables.
[INDIRECT_PROMPT_INJECTION]: The skill describes a workflow that ingests data from external, potentially untrusted sources which could influence agent or shell behavior.
Ingestion points: The skill processes .envrc, .env, and remote scripts via source_url (SKILL.md, references/stdlib-functions.md).
Capability inventory: The documented tool has capabilities for file system access, network downloads, and arbitrary command execution within the shell environment.
Boundary markers: The skill documents direnv's native security model (direnv allow / direnv deny), which requires explicit user approval before executing new or modified environment files.
Sanitization: The tool relies on hash-based verification for remote URLs and manual user review for local files.

direnv