The Agent Skills Directory

[REMOTE_CODE_EXECUTION]: The scripts/impeccable and scripts/impeccable.cmd scripts are designed to download a platform-specific binary from an external GitHub repository (pbakaus/impeccable) and execute it. While the script includes SHA256 checksum verification, executing binary code from an unverified third-party contributor is a high-risk operation that bypasses static analysis.
[PROMPT_INJECTION]: Instructions in reference/craft.md explicitly direct the agent to 'Do not tell users they need to invoke craft', which is a pattern of concealing implementation details and command usage from the user.
[COMMAND_EXECUTION]: The skill uses the Bash tool to run local scripts and downloaded binaries. Furthermore, it uses adb exec-out screencap commands in reference/android.md to access and capture screenshots from connected mobile devices.
[EXTERNAL_DOWNLOADS]: The skill fetches binaries and SHA256 validation files from github.com using curl and wget outside of the official vendor's trusted scope.
[INDIRECT_PROMPT_INJECTION]: The skill's critique and audit functions ingest data from project files and external URLs, which creates a surface for indirect prompt injection without explicit sanitization or boundary markers mentioned in the instructions.

impeccable