The Agent Skills Directory

[PROMPT_INJECTION]: The skill employs a heavy obfuscation technique where the primary instructions are encrypted. It explicitly directs the agent to execute a decryption tool and follow the resulting output "to the letter," which is a mechanism to bypass static safety reviews and control agent behavior dynamically.
[REMOTE_CODE_EXECUTION]: The skill uses uvx lovstudio-skill-helper to fetch and execute a remote tool for instruction decryption at runtime. This allows for arbitrary code or instruction delivery that is not present in the skill package itself.
[REMOTE_CODE_EXECUTION]: The installation process for the wcx dependency (pip install git+https://github.com/lovstudio/wcx.git) downloads and executes code directly from a remote Git repository.
[COMMAND_EXECUTION]: The agent is instructed to run multiple shell commands with user-derived context, including uvx, npx, npm, and pip, which increases the attack surface for command injection if license keys or paths are manipulated.
[EXTERNAL_DOWNLOADS]: The skill facilitates the download of third-party tools and encrypted payloads from external sources like GitHub and vendor-controlled domains (lovstudio.ai).

lovstudio-wxmp-cracker