The Agent Skills Directory

[REMOTE_CODE_EXECUTION]: The skill contains instructions for the agent to download and execute remote shell scripts directly from the internet using the curl | bash pattern, which is a significant execution risk.
Evidence in assets/beads-backend.yml: install: "curl -fsSL https://raw.githubusercontent.com/steveyegge/beads/main/install.sh | bash" targets a personal repository not listed as a trusted source.
Evidence in assets/beads-viewer.yml: install: "curl -fsSL https://raw.githubusercontent.com/Dicklesworthstone/beads_viewer/main/install.sh | bash" targets another personal repository without verification.
[COMMAND_EXECUTION]: The skill extensively uses shell-based tools and CLI utilities (gh, bd, bv) with commands that interpolate user-provided or external data into shell strings.
Example in assets/github-backend.yml: gh issue create --title "{title}" --body "{body}" interpolates variables directly into the command line.
Example in assets/file-backend.yml: Uses complex shell pipes and redirection to manage local task files, which are susceptible to command injection if filenames or metadata are manipulated.
[INDIRECT_PROMPT_INJECTION]: The skill acts as a bridge for data from external task management systems, creating a vulnerability surface where malicious external content could influence agent behavior.
Ingestion points: Reads issues, comments, and task metadata from GitHub, Linear, and Beads backends, as well as configuration from CLAUDE.md and .agents.yml.
Boundary markers: None identified. The skill does not provide instructions for the agent to use delimiters or ignore instructions embedded within the backlog items it retrieves.
Capability inventory: The skill possesses the ability to execute shell commands, write files to the local directory (in the file-backend), and invoke MCP tools.
Sanitization: There are no documented steps for validating or escaping content retrieved from external backends before it is displayed to the agent or used in command arguments.

backlog-manager