The Agent Skills Directory

[EXTERNAL_DOWNLOADS]: The skill provides instructions to download installation scripts from external sources, specifically https://astral.sh/uv/install.sh and https://github.com/j178/prek/releases/latest/download/prek-installer.sh. These are used to set up project management and pre-commit tools.
[REMOTE_CODE_EXECUTION]: Recommends the use of piped shell execution patterns (curl | sh) for installing the uv and prek tools. This method executes remote scripts directly in the user's environment with high impact if the source or connection is compromised.
[COMMAND_EXECUTION]: The migration guide in SKILL.md provides a shell script snippet that iterates through a requirements.txt file and executes uv add for each entry. This represents an automated command execution surface that operates on external, untrusted data.
Ingestion points: requirements.txt file processed in the migration guide (SKILL.md).
Boundary markers: None; the script assumes valid package names but does not verify them against a whitelist or escape them.
Capability inventory: uv add (package installation and script execution via hooks).
Sanitization: None; simple grep filters are used to strip comments and empty lines but do not sanitize package identifiers.
[DATA_EXFILTRATION]: Includes example scripts in SKILL.md and references/pep723-scripts.md that perform network requests to httpbin.org and api.example.com. While intended for demonstration, these demonstrate the capability to transmit data to external domains.

modern-python