The Agent Skills Directory

[REMOTE_CODE_EXECUTION]: The skill's primary function is to fetch and execute code from arbitrary remote sources, such as repository URLs and package registries (npm, PyPI, etc.). It explicitly directs the agent to "follow the README quickstart exactly," a pattern that commonly involves executing untrusted shell scripts or binaries directly from the internet.
[DATA_EXFILTRATION]: The skill uses tailscale serve to expose local network ports to the user's Tailscale network. While restricted to the tailnet, this capability allows potentially malicious software to expose internal services or sensitive UIs to other devices on the network without explicit firewall configuration.
[INDIRECT_PROMPT_INJECTION]: The skill processes untrusted external content, including llms.txt files, README documentation, and website content, to determine its execution steps. A malicious repository could include hidden instructions in these files to hijack the agent's session or perform actions outside the intended sandbox.
Ingestion points: Processes content from llms.txt, README files, and documentation URLs (SKILL.md).
Boundary markers: None identified; the agent is not instructed to ignore embedded instructions within these data sources.
Capability inventory: Includes shell execution, file system modifications, package installation (npm, bun, uv), Docker container management, and network exposure via Tailscale.
Sanitization: No sanitization or validation of the instructions found in external documentation is performed before execution.
[COMMAND_EXECUTION]: The skill executes arbitrary CLI tools against user repositories for "CLI spikes." Compromised or malicious CLI tools could perform unauthorized file operations or exfiltrate data from the user's projects.
[DYNAMIC_EXECUTION]: The agent is instructed to synthesize and execute custom "spike" scripts at runtime based on the perceived requirements of the target software. This dynamic generation of executable code based on untrusted documentation poses a risk of unintended command execution.
[PRIVILEGE_ESCALATION]: The skill manages Docker containers and background processes. On many systems, Docker requires elevated privileges or membership in specific groups that could be leveraged by a malicious container to impact the host environment.

try