The Agent Skills Directory

[REMOTE_CODE_EXECUTION]: The documentation in README.md provides an installation command that downloads a remote script and pipes it directly into the shell.
Evidence: curl -fsSL https://raw.githubusercontent.com/Milkywayrules/verasic-skills/main/setup.sh | bash
[EXTERNAL_DOWNLOADS]: The skill performs automated fetches of configuration files, agent definitions, and version metadata from the vendor's GitHub infrastructure.
Evidence: scripts/profile.sh uses curl to download agent files and rules from raw.githubusercontent.com/Milkywayrules/verasic-skills/main/cursor/ to the local repository.
Evidence: scripts/init.sh performs network requests to check for skill updates from the same source.
[COMMAND_EXECUTION]: The orchestrator script executes local shell scripts to perform repository-level initialization and wiring tasks.
Evidence: SKILL.md instructs the agent to execute bash .cursor/skills/verasic-init/scripts/init.sh.
Evidence: scripts/init.sh runs various setup scripts defined in manifest.txt, including scripts/bootstrap.sh and scripts/wire-hook.sh.
[PERSISTENCE]: The skill configures repository settings to ensure specific scripts execute during git lifecycle events.
Evidence: The verasic-git-commits-convention skill wires core.hooksPath to point to a local directory containing a commit-msg hook script.
[INDIRECT_PROMPT_INJECTION]: The skill introduces a surface for indirect prompt injection by downloading and placing remote Markdown files into agent configuration directories where they are later parsed as instructions.
Ingestion points: scripts/profile.sh populates .cursor/agents/ and .cursor/rules/ with remote content fetched via curl.
Boundary markers: None identified in the download and placement process.
Capability inventory: The skill possesses filesystem write, network access, and shell execution capabilities.
Sanitization: Downloaded Markdown and MDC content is not sanitized or validated before being placed into the agent's context.

verasic-init