The Agent Skills Directory

[REMOTE_CODE_EXECUTION]: The skill provides instructions to download the official FontPatcher utility from GitHub (https://github.com/ryanoasis/nerd-fonts/releases/latest/download/FontPatcher.zip) and execute it using the fontforge script interpreter. This is a functional requirement for users wishing to patch their own fonts. Automated scanner alerts regarding glyphnames.json are evaluated as false positives, as that file is a JSON data source processed by parsing tools like jq and awk rather than being executed as code.\n- [EXTERNAL_DOWNLOADS]: The skill fetches glyph data snapshots, font archives, and project utilities from the official Nerd Fonts website and GitHub repository (ryanoasis/nerd-fonts).\n- [COMMAND_EXECUTION]: Instructions include shell commands for data lookup, alignment verification, and repository management using standard tools such as printf, grep, awk, jq, and cargo.\n- [PRIVILEGE_ESCALATION]: Installation guides for Linux environments include the use of sudo for system-wide font package installation through the pacman package manager.\n- [INDIRECT_PROMPT_INJECTION]: The skill's feature for reviewing files processes arbitrary user-supplied content, creating a vulnerability surface for instructions embedded in external data. In accordance with the mandatory evidence chain:\n
Ingestion points: User-provided file content processed via the /nerd-fonts command pattern in SKILL.md.\n
Boundary markers: None identified in the prompt instructions to separate data from instructions.\n
Capability inventory: Shell command execution (printf, grep, awk, jq) and network capability (curl).\n
Sanitization: No explicit content filtering, escaping, or validation for user-provided file content is defined.

nerd-fonts