The Agent Skills Directory

[REMOTE_CODE_EXECUTION]: The helper script bin/control-libreuiux allows users to fetch code from arbitrary Pull Requests via the --pr flag. This code is then used to execute repository-specific scripts such as setup.sh and scripts/check.sh. This provides an avenue for the execution of untrusted remote code provided by third-party contributors to the repository.
[COMMAND_EXECUTION]: The skill relies on several system CLI tools, including git, jq, claude, and grok. Notably, it uses the --trust flag when performing plugin installations with the grok CLI, which bypasses security confirmations and non-interactive trust checks, effectively allowing auto-installation of components.
[INDIRECT_PROMPT_INJECTION]: The skill acts as an automated execution harness for external data (the source code from the local tree or remote PRs). It is vulnerable to malicious instructions or scripts embedded within the plugin manifests or scripts it processes.
Ingestion points: The skill ingests file content and manifests from the local repository or remote GitHub PR closures.
Boundary markers: While it attempts to isolate configuration data by setting CLAUDE_CONFIG_DIR and GROK_HOME to scratch directories, it does not sandbox the shell environment or the execution of the bash/python scripts.
Capability inventory: The skill utilizes full shell capabilities, including script execution via bash and python3.
Sanitization: There is no verification of script integrity or sanitization of external manifests before they are used to drive CLI commands or script execution.

verify-libreuiux