The Agent Skills Directory

[REMOTE_CODE_EXECUTION]: The skill executes a background process (update-check.js) that is explicitly designed to perform silent updates. This mechanism allows for the downloading and execution of modified code versions without user notification or approval, representing a high-risk persistence and code execution vector.
[DATA_EXFILTRATION]: The skill automatically collects sensitive project information, including dependencies and versions from manifests (package.json, requirements.txt, Cargo.toml, etc.) and arbitrary source code files. This data is written to a temporary file and transmitted to an external service via the grep-api.js script, creating a significant data exposure surface.
[COMMAND_EXECUTION]: The skill uses computed shell paths involving readlink and multiple dirname calls to locate and execute Node.js scripts. Additionally, the <refined_query>, which is enriched by the agent, is interpolated directly into a shell command (node ... run "<refined_query>"), which could be exploited for command injection if the query contains shell metacharacters.
[PROMPT_INJECTION]: The skill is vulnerable to indirect prompt injection as it ingests and presents untrusted research reports from an external API.
Ingestion points: The output of grep-api.js (research reports) is presented to the user and the agent's context.
Boundary markers: No explicit delimiters or instructions are provided to the agent to treat the external research output as untrusted or to ignore instructions embedded within it.
Capability inventory: The skill possesses capabilities for shell execution (Bash), background task monitoring (Monitor), and file system access (read/write in /tmp).
Sanitization: No sanitization, filtering, or validation of the research report content is performed before it is processed or displayed.

research