The Agent Skills Directory

[EXTERNAL_DOWNLOADS]: The research workflow includes instructions to execute the @rayhanadev/truffler package via bunx. This results in the download and execution of code from the public npm registry provided by an unverified third-party account.
[COMMAND_EXECUTION]: The skill provides a pre-defined shell command (bunx @rayhanadev/truffler ...) designed to perform fuzzy searches across the local filesystem. Executing unverified third-party tools with access to the project source code presents a risk to the integrity of the development environment.
[PROMPT_INJECTION]: The skill exhibits an indirect prompt injection surface by ingesting external data (code patterns and research evidence) and interpolating it into prompts for further AI processing. The workflow lacks security boundary markers or sanitization logic to prevent malicious instructions embedded in the processed source code from influencing the agent's behavior. Evidence includes ingestion of codebase paths in SKILL.md, absence of delimiters in the RDE Idea Prompt, and existing capabilities to execute shell commands.

rule-research