The Agent Skills Directory

[REMOTE_CODE_EXECUTION]: The skill's documentation and error messages (e.g., in scripts/parable.py and references/providers.md) explicitly instruct users to install external software by piping remote content directly to a shell: curl https://cursor.com/install -fsS | bash. This pattern bypasses inspection and is a classic remote code execution vector.
[EXTERNAL_DOWNLOADS]: During setup (runtime/lib/onboarding.js), the skill clones source code from an external, untrusted GitHub repository (github.com/router-for-me/CLIProxyAPI.git) using a hardcoded commit hash. This introduces a supply-chain risk as the code is sourced from outside the vendor's or platform's trusted infrastructure.
[PERSISTENCE]: The installation script parable.sh modifies user shell profiles (~/.bashrc, ~/.zshrc, or ~/.profile) to append a custom directory to the system PATH. This ensures the parable command remains available across sessions but constitutes a persistence mechanism that alters environment behavior.
[DYNAMIC_EXECUTION]: The buildProxy function in runtime/lib/onboarding.js performs runtime compilation of the downloaded proxy source code using go build after applying a local patch. Executing dynamically compiled binaries from untrusted sources is a high-risk operation.
[COMMAND_EXECUTION]: The Python dispatcher scripts/parable.py utilizes subprocess.run with shell=True to execute verification checks (cmd_verify). This allows for arbitrary shell command execution based on configuration values, which could be exploited if check commands are tampered with.
[DATA_EXFILTRATION]: The scripts/parable_usage.py script accesses sensitive local credential files, such as ~/.claude/.credentials.json and ~/.codex/auth.json, and environment variables like CURSOR_API_KEY. It transmits information derived from these secrets to external usage endpoints (e.g., api.anthropic.com, chatgpt.com, api2.cursor.sh) to track subscription headroom.
[INDIRECT_PROMPT_INJECTION]: The skill processes plan.md files as input for various model executors. This creates an attack surface for indirect prompt injection.
Ingestion points: The skill reads plan files from the log_dir/runs/ directory.
Boundary markers: The skill prepends a WORKSPACE_CONTRACT block to the plans but lacks strict delimiters to prevent instruction override at the end of the file.
Capability inventory: The skill can write to the working directory, execute shell commands via verification checks, and perform network operations for usage tracking.
Sanitization: No sanitization or validation of the plan content is performed before passing it to subagents or external harnesses.

parable