The Agent Skills Directory

[REMOTE_CODE_EXECUTION]: The skill executes a script using a relative path that escapes the current skill directory in the preamble: bash "$(dirname "${BASH_SOURCE[0]}")/../../check-update.sh". This pattern depends on the environment layout and can result in the execution of unintended scripts if the directory structure is manipulated.
[DYNAMIC_EXECUTION]: The skill uses a discovery mechanism to find the path for anysearch_cli.py across multiple system and user directories (e.g., ~/.claude/skills/, /usr/local/bin/). It also uses python3 -c to dynamically resolve package locations. Once discovered, the agent is instructed to execute this script via python3 <path>, which constitutes the execution of code not distributed directly with the skill.
[EXTERNAL_DOWNLOADS]: The instructions explicitly suggest that the user install external code from a remote repository: git clone https://github.com/konglong87/anysearch.git. While this originates from the vendor's repository, it encourages the introduction of external code into the agent's environment.
[INDIRECT_PROMPT_INJECTION]: The skill is designed to ingest large amounts of untrusted data from the web via WebSearch, Exa MCP, and AnySearch. This content is then "integrated" into final reports without sanitization, creating a vulnerability surface.
Ingestion points: Data enters the context via mcp__exa__web_search_exa, WebSearch, and anysearch_cli.py output (SKILL.md).
Boundary markers: None. The instructions do not specify delimiters or warnings to ignore instructions embedded in the search results.
Capability inventory: The agent has access to Write (to create docs/), Bash (to execute scripts), and Agent (to spawn sub-tasks) (SKILL.md).
Sanitization: No escaping or validation of external content is mentioned before the data is processed or written to files.

pm-search