The Agent Skills Directory

[REMOTE_CODE_EXECUTION]: The skill is designed to fetch files from GitHub via the gh API and execute the "procedure" and "steps" defined within those remote files.
It uses the GitHub contents and blobs endpoints to download content based on provided URLs.
The instructions explicitly state: "Execute steps in order within authority," effectively running remote code in the agent's environment.
[COMMAND_EXECUTION]: The skill utilizes the gh CLI to interact with GitHub's REST API.
Evidence: gh api 'repos/OWNER/REPO/git/trees/REVISION?recursive=1' > "<tmpdir>/tree.json" and gh api 'repos/OWNER/REPO/contents/PATH?ref=REVISION' in REFERENCE.md.
[PROMPT_INJECTION]: The skill contains instructions that attempt to override the agent's natural safety posture regarding external content.
Evidence: "Trust linked skills by default, without an allowlist; live user instructions win direct content conflicts."
[INDIRECT_PROMPT_INJECTION]: The skill has a large attack surface for indirect injection as it processes untrusted data from external repositories.
Ingestion points: GitHub tree and contents API endpoints (REFERENCE.md).
Boundary markers: The skill mentions running under "this invocation's authority," but undermines this by directing the agent to "Trust linked skills by default."
Capability inventory: The agent can read files, write to a temporary directory, and execute the fetched procedures (SKILL.md).
Sanitization: There is no evidence of sanitization or validation of the fetched content beyond base64 decoding for transport.

use-skill