The Agent Skills Directory

[EXTERNAL_DOWNLOADS]: The skill is designed to fetch content from user-provided URLs and GitHub repositories. This includes cloning entire repositories and downloading zip files from arbitrary domains.
[REMOTE_CODE_EXECUTION]: The post-installation logic automatically runs pip install -r requirements.txt on content retrieved from external sources. Since the source content is not validated, this allows for the execution of arbitrary code during the package installation process.
[COMMAND_EXECUTION]: The skill directs the agent to execute high-impact shell commands such as rm -rf for skill removal and git clone for installation. These operations could lead to accidental or malicious data loss if the skill name or path is manipulated. Additionally, the skill mentions using sudo to resolve permission errors, which could lead to unauthorized privilege escalation.
[PROMPT_INJECTION]: The skill exhibits an indirect prompt injection surface. It ingests untrusted data from external sources (SKILL.md files and repository contents) which the agent is then instructed to verify and potentially use. There are no boundary markers or sanitization steps to prevent malicious instructions within the downloaded skills from influencing the agent's future behavior.

managing-skills