The Agent Skills Directory

[REMOTE_CODE_EXECUTION]: The workflow allows for the installation of arbitrary third-party code. Step 5 instructs the agent to copy patterns from cloned community repositories into the local skill directory (~/.claude/skills/). This results in the potential execution of unverifiable code from untrusted sources once integrated into the agent's environment.
[EXTERNAL_DOWNLOADS]: The skill performs several network operations to fetch external content from untrusted sources.
Uses gh api to fetch and base64-decode the README from the hesreallyhim/awesome-claude-code repository.
Uses gh repo clone to download entire repositories from arbitrary GitHub users based on findings in the community list.
[COMMAND_EXECUTION]: The skill relies on complex shell command chains to manage remote resources and process external data.
Uses bash to execute local security scripts on downloaded content.
Uses grep, xargs, and find to scan downloaded code for network-related keywords like curl, wget, or nc.
[PROMPT_INJECTION]: The skill is vulnerable to indirect prompt injection (Category 8).
Ingestion points: Fetches the community README via GitHub API (Step 2).
Boundary markers: None present to distinguish instructions from the fetched README content.
Capability inventory: Full Bash access, gh CLI usage, and file system write access to skill directories.
Sanitization: Relies on external scripts (check-secrets.sh, check-gbrain-ban.sh) that are not provided within the skill itself, making the sanitization unverifiable.

linkdrop-x-0x-kaize-awesome-claude-code-repos