The Agent Skills Directory

[REMOTE_CODE_EXECUTION]: The skill provides instructions to download and execute a shell script from an external, untrusted GitHub repository using a dangerous piped-bash pattern.
Evidence: In SKILL.md, the command curl -fsSL https://raw.githubusercontent.com/DeusData/codebase-memory-mcp/main/install.sh | bash -s -- --skip-config is explicitly provided for the agent to install the tool.
[EXTERNAL_DOWNLOADS]: The skill fetches code and configuration from a third-party source not associated with a trusted vendor or the author's verified infrastructure.
Evidence: The download URL https://raw.githubusercontent.com/DeusData/codebase-memory-mcp/main/install.sh points to the DeusData organization on GitHub, which is not a recognized trusted source.
[COMMAND_EXECUTION]: The skill relies on executing various shell commands to interact with the local CLI tool, creating a surface for potential misuse or command injection if parameters are not carefully controlled.
Evidence: Extensive use of codebase-memory-mcp cli <tool> commands across SKILL.md and references/commands.md.
[DATA_EXFILTRATION]: The skill's primary function is to index and search codebases, which involves reading sensitive source code, configuration files, and architecture details, posing a risk of sensitive data exposure.
Evidence: Tools such as get_code_snippet, search_code, and trace_path in SKILL.md allow the agent to read and process potentially sensitive local file contents.

using-codebase-memory-cli