The Agent Skills Directory

[REMOTE_CODE_EXECUTION]: The skill instructs the user to install and execute untrusted NPM packages. Specifically, it recommends npm install -g @anthropic-ai/gemini-cli. This is highly suspicious as Anthropic is a competitor to Google and would not host a CLI for Google's Gemini models. This suggests a potential supply chain attack using a deceptive package name to gain execution on the user's machine.
[EXTERNAL_DOWNLOADS]: The instructions direct users to download and install global packages (@openai/codex, @anthropic-ai/gemini-cli) that do not appear to be official tools from the respective vendors. The mismatch between the package name @anthropic-ai/gemini-cli and the provided documentation link https://github.com/google-gemini/gemini-cli is a critical security red flag.
[COMMAND_EXECUTION]: The skill uses shell interpolation to execute these external CLIs (e.g., codex exec ... "<prompt>"). If the prompt contains shell metacharacters like backticks or semicolons, it could lead to arbitrary command execution on the host system beyond the intended LLM query.
[INDIRECT_PROMPT_INJECTION]: The skill provides a framework for ingesting and processing data from external, untrusted sources (the outputs of external LLMs). This creates a surface for indirect prompt injection where the external model's output could contain instructions that trick the primary agent into performing unauthorized actions when it 'parses and structures' the response.

external-llm-consulting