The Agent Skills Directory

[REMOTE_CODE_EXECUTION]: The skill provides instructions to execute the @rayhanadev/truffler package using bunx. This results in the automatic download and execution of external code at runtime. The package is maintained by an unverified third party rather than the skill author or a trusted organization.
[EXTERNAL_DOWNLOADS]: The use of bunx @rayhanadev/truffler triggers a download from the npm registry. Since the package originates from an untrusted author account, it constitutes an unverifiable external dependency.
[COMMAND_EXECUTION]: The skill uses shell-based tooling (bunx) to perform code analysis and consolidation tasks, which involves executing external CLI tools within the agent's environment.
[PROMPT_INJECTION]: The skill is designed to ingest and process arbitrary code modified in the current session, which creates an attack surface for indirect prompt injection. Malicious instructions hidden in code comments or logic could potentially hijack the agent's behavior.
Ingestion points: Recently modified or touched code files within the current session.
Boundary markers: No delimiters or instructions are provided to the agent to distinguish between code logic and potential embedded instructions.
Capability inventory: Includes the ability to execute shell commands and modify file contents.
Sanitization: The skill lacks any explicit mechanisms to sanitize or validate the content of the code before processing it.

deslop