The Agent Skills Directory

[REMOTE_CODE_EXECUTION]: The file references/connector.md includes a shell command for the user to install a utility: curl -fsSL https://raw.githubusercontent.com/kjanat/envctl/master/install.sh | bash. This pattern fetches a script from a remote source and executes it directly without prior verification. The target repository belongs to the skill author (kjanat).
[EXTERNAL_DOWNLOADS]: The skill retrieves information from external sources:
API specifications and Postman collections from official Ubiquiti domains (developer.ui.com).
Site inventory and device data from the UniFi Site Manager API (api.ui.com).
Installation scripts from the author's GitHub repository (raw.githubusercontent.com/kjanat/envctl/).
[DATA_EXFILTRATION]: The skill is designed to read and transmit sensitive network configurations, client lists, and firewall policies to the external api.ui.com endpoint. It also accesses the UBIQUITI_API_KEY stored in local configuration files like ~/.claude/settings.json.
[COMMAND_EXECUTION]: The helper script scripts/unifi-query.sh executes shell commands, including curl for network communication, jq for parsing JSON responses, and mktemp for creating temporary files during execution.
[INDIRECT_PROMPT_INJECTION]: The skill ingests data from external API responses, which could potentially contain untrusted instructions.
Ingestion points: API response bodies fetched and processed in scripts/unifi-query.sh.
Boundary markers: None identified; API data is processed without explicit delimiters.
Capability inventory: Network requests via curl and temporary file creation via mktemp.
Sanitization: No explicit sanitization or filtering of the API content is performed before it is added to the agent context.

unifi-network