The Agent Skills Directory

Privilege Escalation: The skill is designed to use sudo with various Linux package managers (like apt-get, dnf, yum, and pacman) to install software. This grants the agent the ability to execute commands with administrative privileges. While this is a standard requirement for system-wide software installation, it represents an escalation of the agent's default permissions.
Persistence Mechanism: The skill instructions include steps to modify the system's PATH environment variable permanently. In a Linux or macOS environment, this typically involves modifying shell configuration files such as ~/.bashrc or ~/.zshrc. This is a common setup task but technically qualifies as a persistent change to the user's environment configuration.
Indirect Prompt Injection: The skill possesses a significant attack surface for indirect prompt injection because it ingests instructions from repository files and external documentation.
Ingestion points: The agent reads content from README.md, CONTRIBUTING.md, and recommended documentation links found within the repository.
Boundary markers: There are no explicit delimiters or instructions to ignore embedded malicious prompts within the processed data.
Capability inventory: The agent has the ability to execute shell commands, install software via system package managers, modify system environment variables, and write to local files.
Sanitization: The skill lacks formal sanitization or validation of the external instructions it follows, relying instead on a directive to "cross-check versions."
Automated Command Execution: The skill is instructed to "execute commands directly" rather than just displaying them. This includes running build scripts and application binaries found within the repository, which could lead to the execution of untrusted code if the repository itself is malicious.

setup-environment