The Agent Skills Directory

[REMOTE_CODE_EXECUTION]: The skill instructs the agent to use npx ax@0.7 audit, which downloads and executes code from the NPM registry at runtime. While the tool is provided by the vendor, dynamic package execution represents a potential vector for supply chain attacks or remote code execution.
[COMMAND_EXECUTION]: The skill documents the use of the --tunnel-cmd flag (e.g., npx ax@0.7 audit localhost:3000 --tunnel-cmd 'ngrok http 3000 --log stdout'). This parameter allows the execution of arbitrary shell commands. If the command string is manipulated, it could lead to unauthorized command injection on the host system.
[INDIRECT_PROMPT_INJECTION]: The skill establishes an indirect prompt injection surface by processing untrusted data from the Ora API (https://ora.ai/api/scan). It explicitly directs the agent to "Work it top to bottom; render it verbatim" from the topFixes server-ranked list.
Ingestion points: Audit results in JSON format from the ax CLI, MCP scan_domain tool, or REST API.
Boundary markers: No delimiters or safety instructions are used to separate the external fix instructions from the agent's core logic.
Capability inventory: The skill possesses the capability to execute shell commands and modify local website files based on the audit results.
Sanitization: The instructions explicitly forbid re-ranking or validation, requiring the agent to render the remote content verbatim.
[PROMPT_INJECTION]: The skill contains a meta-instruction: "This skill is served dynamically... always work from a freshly fetched copy rather than a memorized one." This encourages the agent to prioritize remote, potentially unverified instructions over its static safety guidelines and memorized context, which could be used to facilitate a multi-stage injection attack.

agent-ready-website