The Agent Skills Directory

[EXTERNAL_DOWNLOADS]: The skill's prepare command clones a remote repository from https://github.com/mattpocock/skills.git using the git clone command. This repository is not maintained by a trusted vendor listed in the security policy.
[REMOTE_CODE_EXECUTION]: The install_upstream function in scripts/project_init.py executes a Python script provided via the --installer argument. The script is run using subprocess.run([sys.executable, installer, ...]), which effectively executes external Python logic during project initialization.
[COMMAND_EXECUTION]: The script extensively uses subprocess.run to execute system-level commands such as git init, git clone, git rev-parse, and git check-ignore. This provides the skill with high-level control over the local environment and Git configuration.
[DYNAMIC_EXECUTION]: The skill dynamically invokes a script (the 'installer') whose path is determined at runtime based on user-supplied arguments. This creates a vector for executing arbitrary scripts located on the disk if the agent is convinced to point to a malicious file.
[INDIRECT_PROMPT_INJECTION]: The skill processes untrusted metadata and content from the local project (e.g., AGENTS.md, CLAUDE.md) to generate project-specific instructions, creating a surface for indirect prompt injection.
Ingestion points: The Project.merge method and source_fingerprint function read local files into variables for processing and hashing.
Boundary markers: It uses  and  markers to separate managed content, but these do not sanitize the ingested text.
Capability inventory: The skill possesses file write permissions, command execution capabilities, and network access via Git.
Sanitization: The skill verifies the integrity of file blocks and directory structures using hashes but lacks content-level sanitization for the natural language instructions it aggregates.

dl-init