The Agent Skills Directory

[EXTERNAL_DOWNLOADS]: The skill instructs the agent to install an external Python package using pip install --upgrade "desloppify[full]". The documentation references https://github.com/peteromallet/desloppify as the source, which is an untrusted personal repository, posing a supply chain risk.
[REMOTE_CODE_EXECUTION]: Following installation, the skill immediately executes the downloaded tool via shell commands such as desloppify scan and desloppify update-skill opencode. This pattern allows for the execution of arbitrary remote code on the user's system.
[COMMAND_EXECUTION]: The skill accepts $ARGUMENTS which include user-defined paths (e.g., --path <dir>). These arguments are directly interpolated into shell commands (desloppify scan --path .), creating a risk of command injection if the input is not properly sanitized by the agent platform.
[PROMPT_INJECTION]: The skill facilitates indirect prompt injection by scanning external codebases where malicious instructions could be embedded.
Ingestion points: The tool reads the entire directory at the specified path (.) via desloppify scan (SKILL.md, Phase 2).
Boundary markers: No boundary markers or delimiters are defined to separate codebase content from agent instructions.
Capability inventory: The skill has the capability to run shell commands (pip, bash, desloppify) and modify files via the desloppify resolve workflow.
Sanitization: There is no evidence of sanitization or filtering applied to the findings generated from the scanned code before they are processed by the agent.

flux-opencode-desloppify