The Agent Skills Directory

[EXTERNAL_DOWNLOADS]: The skill instructs the user to clone a third-party repository (github.com/hamelsmu/hamelnb) to a local directory (~/.agent-skills/hamelnb). This source is not verified or managed by a trusted organization.
[REMOTE_CODE_EXECUTION]: The skill executes a specific Python script (jupyter_live_kernel.py) from the downloaded third-party repository using uv run. This represents a supply chain risk where malicious updates to the repository could lead to arbitrary code execution on the host machine.
[COMMAND_EXECUTION]: The setup instructions explicitly disable Jupyter's security features by setting --IdentityProvider.token='' and --ServerApp.password=''. This allows any process on the local machine to interact with the Jupyter REST API and execute arbitrary code in the kernel without authentication.
[INDIRECT_PROMPT_INJECTION]: The skill creates a high-risk attack surface by ingesting and executing Python code that may be derived from untrusted user input.
Ingestion points: The execute command takes a --code argument which is interpolated into a shell command for the Jupyter kernel.
Boundary markers: None. There are no delimiters or instructions to the agent to sanitize or ignore embedded instructions within the code block.
Capability inventory: Full Python 3 execution environment with persistence, file system access, and network capabilities.
Sanitization: None identified. The script appears to pass the code string directly to the Jupyter session.
[DYNAMIC_EXECUTION]: The primary purpose of this skill is the dynamic execution of Python code in a stateful REPL environment, which is inherently risky if the input source is not strictly controlled.

jupyter-live-kernel