The Agent Skills Directory

[REMOTE_CODE_EXECUTION]: The skill instructions in SKILL.md and workflows/agent-simulation.md recommend installing the tpc CLI by fetching a shell script from https://cli.promptingco.com/install.sh and piping it directly to bash (curl -fsSL https://cli.promptingco.com/install.sh | bash). This pattern allows a remote server to execute arbitrary code on the host system without prior user review.
[COMMAND_EXECUTION]: The skill makes extensive use of the tpc CLI tool to perform operations such as task creation, environment management, and running simulations. Examples include tpc sim task create, tpc sim env task attach, and tpc sim task run.
[INDIRECT_PROMPT_INJECTION]: The GEO simulation workflow processes untrusted external data from community forums to generate prompts.
Ingestion points: Phase 1 (Research) in workflows/geo-simulation-prompts.md involves searching and extracting verbatim phrases from Reddit, Hacker News, and Stack Overflow discussions.
Boundary markers: No explicit delimiters or instructions to ignore embedded prompts are included in the prompt generation logic.
Capability inventory: The skill environment executes shell commands via the tpc CLI and performs file writes to the local filesystem.
Sanitization: The skill relies on manual "Quality review" and a "Vocabulary banned list" rather than robust automated sanitization or input validation of the scraped content.
[DYNAMIC_EXECUTION]: The skill dynamically generates a task.json configuration file based on user-provided product context and then executes it using the tpc CLI tool in workflows/agent-simulation.md.

generative-engine-optimization