The Agent Skills Directory

[REMOTE_CODE_EXECUTION]: The skill implements an automatic update mechanism in functions/auto_updater.py that fetches release metadata from a third-party GitHub repository (github.com/alekspetrov/navigator) and invokes the plugin manager to update the skill's code. This automatic execution of code from an external, non-trusted source represents a significant security risk.
[DYNAMIC_EXECUTION]: The script functions/workflow_detector.py uses dynamic code loading by manipulating sys.path to include a directory calculated at runtime (parents[3] / "hooks" / "nav_hook_lib") and then importing the scoring module. This technique can be used to load unverified code or bypass static analysis.
[INDIRECT_PROMPT_INJECTION]: The skill is vulnerable to indirect prompt injection through project-controlled files.
Ingestion points: In SKILL.md Step 4, the skill reads the contents of the file .agent/.context-markers/.active to determine which marker to load.
Boundary markers: There are no boundary markers or validation steps to distinguish the file content from instructions or to verify the legitimacy of the path retrieved.
Capability inventory: The skill possesses the Read and Bash tools, as defined in SKILL.md and utilized in various Python functions.
Sanitization: The value retrieved from the marker file is interpolated directly into a Read tool call without sanitization, creating a path traversal vulnerability that could allow an attacker to read arbitrary files by manipulating the .active marker file.
[COMMAND_EXECUTION]: The skill extensively uses the Bash tool to execute system commands and utility scripts. It runs python3 for logic and telemetry, gh for project management tasks, and claude CLI commands for plugin management.
[TIME_DELAYED_CONDITIONAL]: The auto-update process is gated by a time-based condition in auto_updater.py (checked against check_interval_hours), which causes the update behavior to trigger only periodically rather than on every invocation.
[EXTERNAL_DOWNLOADS]: The skill makes network requests to external domains, specifically to the GitHub API (api.github.com) to check for updates. While the telemetry script targets localhost, the update check targets a non-whitelisted third-party repository.

nav-start