The Agent Skills Directory

[REMOTE_CODE_EXECUTION]: The skill is designed to clone code from arbitrary GitHub URLs provided by the user and then execute that code during testing and verification.
Evidence: SKILL.md instructs the agent to "Verify with pip install -e . && --help" or "npm link && --help" after cloning from a URL.
[COMMAND_EXECUTION]: Automated testing involves running generated binaries via shell commands, which executes the underlying (potentially malicious) logic.
Evidence: commands/cli-anything.md Phase 4 describes running the binary via subprocess (Python) or child_process.exec (Node.js).
[EXTERNAL_DOWNLOADS]: The skill fetches entire projects from external repositories without any pre-execution verification or sandboxing.
Evidence: /cli-anything argument in commands/cli-anything.md triggers a git clone operation followed by installation.
[PROMPT_INJECTION]: The skill is highly susceptible to indirect prompt injection as it processes untrusted source code and metadata from external repositories and incorporates them into its execution flow.
Ingestion points: The argument in the /cli-anything command, which accepts arbitrary local paths or GitHub URLs.
Boundary markers: Absent. The skill does not implement any delimiters or warnings to ignore instructions embedded in the source data.
Capability inventory: subprocess.run, child_process.exec, pip install, npm link, and npm publish are used across SKILL.md and command files.
Sanitization: Absent. The skill explicitly preserves existing logic and "wires" it to entry points without validation.

cli-anything