The Agent Skills Directory

[REMOTE_CODE_EXECUTION]: The setup instructions in references/setup.md recommend running npx --package=github:miguelrios/unc-skills#main tether setup. This command downloads and executes code from a remote third-party GitHub repository at runtime. Additionally, scripts/tether_notify.py uses subprocess.run to execute shell commands to manage the hermes CLI, including installing and restarting gateway services.
[DYNAMIC_EXECUTION]: The script scripts/tether_notify.py uses importlib.util to dynamically import and execute a Python module from ~/.local/share/tether/bridge_runtime.py. This runtime dependency is not included in the skill's static files and is likely installed by the external setup script, creating an execution path for unverified local code.
[INDIRECT_PROMPT_INJECTION]: The skill's primary function is to bridge Slack conversations into agent sessions, which creates an attack surface for indirect prompt injection via untrusted Slack messages. SKILL.md explicitly warns the agent to treat inbound Slack replies as "untrusted operator input."
Ingestion points: Slack message replies and thread history as described in SKILL.md and references/contract.md.
Boundary markers: Employs the NO_REPLY marker to signal intentional silence and provides instructions to treat inputs as untrusted.
Capability inventory: The skill possesses file system access, shell command execution via subprocess.run, and network interaction capabilities through the Hermes gateway.
Sanitization: The skill documentation mentions sanitizing failure responses, but specific code for sanitizing or escaping the incoming Slack data before agent processing is not present in the provided scripts.

tether