The Agent Skills Directory

[REMOTE_CODE_EXECUTION]: The skill contains instructions for the agent to prompt the user to execute curl -fsSL https://www.lazyweb.com/install.sh | bash. This represents a high-risk execution pattern from an untrusted domain that could lead to full system compromise.
[INDIRECT_PROMPT_INJECTION]: The core functionality relies on fetching external instructions from over 40 distinct remote URLs and applying them as "operating best practices" for the agent.
Ingestion points: Remote SKILL.md files are fetched from numerous external GitHub repositories using the WebFetch or lazyweb_fetch_best_practice tools.
Boundary markers: Absent. The instructions explicitly command the agent to "read content in full" and "apply its rules, heuristics, and workflow" without isolation.
Capability inventory: The skill possesses high-privilege capabilities including Bash, Write, and Read across the file system.
Sanitization: There is no evidence of validation, integrity checking, or sanitization of the remote content before it is incorporated into the agent's context.
[EXTERNAL_DOWNLOADS]: The skill references a large number of remote repositories. While some target well-known organizations such as Anthropics, Vercel, and OpenAI, many point to unverified personal repositories, creating a broad supply chain attack surface.
[COMMAND_EXECUTION]: The skill instructs the agent to execute shell commands to read local version files (e.g., cat "$HOME/.lazyweb/VERSION") for use in analytics metadata. This demonstrates an active use of shell capabilities to access local system data.
[DATA_EXFILTRATION]: The skill attempts to collect local system information (version data from the user's home directory) and instructs the agent to include this data as metadata in every outbound lazyweb_* tool call, which constitutes a telemetry/exfiltration pattern.

lazyweb-apply-design-best-practices