The Agent Skills Directory

[EXTERNAL_DOWNLOADS]: The skill clones a remote repository from an untrusted GitHub account (affaan-m/everything-claude-code) to the /tmp directory.
Evidence: git clone https://github.com/affaan-m/everything-claude-code.git /tmp/everything-claude-code in SKILL.md.
[COMMAND_EXECUTION]: The skill executes various shell commands to manipulate the file system, including removing directories, creating paths, and copying files.
Evidence: Uses rm -rf, mkdir -p, and cp -r throughout the installation steps in SKILL.md.
[REMOTE_CODE_EXECUTION]: By copying downloaded content from an untrusted source directly into the agent's configuration directories (~/.claude/skills and ~/.claude/rules), the skill effectively installs unverified instructions that define the agent's future behavior and capabilities.
Evidence: Step 2d and Step 3 describe copying remote skills and rules into the active .claude path.
[COMMAND_EXECUTION]: The skill uses grep to scan for sensitive path references (like ~/.claude/) within the installed files, which can expose local environment details to the agent context.
Evidence: grep -rn "~/.claude/" $TARGET/skills/ $TARGET/rules/ in Step 4b.

configure-ecc