The Agent Skills Directory

[EXTERNAL_DOWNLOADS]: The skill uses npx to download and execute viberaven@1.6.1. While it also uses npx for Vercel, which is a well-known service, the viberaven package originates from a source that is not recognized as a well-known service or trusted organization.
[REMOTE_CODE_EXECUTION]: The instruction to run npx -y viberaven@1.6.1 causes the agent to download code from a remote registry and execute it in the local environment without prior verification of the package content.
[COMMAND_EXECUTION]: The skill is granted high autonomy to execute a variety of shell commands, including git, gh (GitHub CLI), vercel CLI, and project-specific commands like npm install, build, and test. The "Autopilot Contract" encourages the agent to "Run the local inspection commands yourself" and "Run install/build/test commands yourself," which bypasses manual user oversight for these operations.
[INDIRECT_PROMPT_INJECTION]: The skill is vulnerable to indirect prompt injection because it is instructed to process untrusted local project files and execute scripts defined within them.
Ingestion points: The agent reads package.json, vercel.json, .vercel/project.json, and framework configuration files from the local project directory (SKILL.md).
Boundary markers: There are no instructions to validate or sanitize the content of these files before execution, nor are there delimiters to prevent the agent from following instructions embedded within the project files.
Capability inventory: The agent has the capability to execute arbitrary shell commands via the npm, git, and vercel tools (SKILL.md).
Sanitization: The skill lacks sanitization; it explicitly instructs the agent to run project scripts automatically ("Do every safe step for the user instead of describing it"). An attacker could place malicious commands in a project's build or test scripts that would be executed when the user runs this skill.

go-live