The Agent Skills Directory

[REMOTE_CODE_EXECUTION]: The skill uses a dangerous pattern of fetching data from a remote API and piping it directly into a Python interpreter.
Evidence: curl -sL "https://api.github.com/repos/mattpocock/skills/compare/<last_sha>...<UPSTREAM_SHA>" | python3 -c "..." in SKILL.md.
[COMMAND_EXECUTION]: The skill performs multiple shell commands that interact with the local filesystem and external services.
Evidence: Uses gh issue list, gh issue create, and gh issue edit to manage state in GitHub issues.
Evidence: Writes files to the local directory structure using plugins/skills/<name>/SKILL.md and modifies plugins/README.md.
[EXTERNAL_DOWNLOADS]: The skill downloads content from an external repository that is not part of the trusted vendors list.
Evidence: Fetches skill files from https://raw.githubusercontent.com/mattpocock/skills/main/....
[PROMPT_INJECTION]: The skill is highly vulnerable to indirect prompt injection because it ingests untrusted instructions and incorporates them into the agent's core capability set.
Ingestion points: Fetches SKILL.md content from the mattpocock/skills GitHub repository (untrusted source).
Boundary markers: No delimiters or "ignore embedded instructions" warnings are used when writing the downloaded content to new local skill files.
Capability inventory: The skill can write files (SKILL.md), modify the project README, and edit GitHub issues via the gh CLI.
Sanitization: No security-focused sanitization is performed on the ingested content; the "compliance checks" only verify formatting and cross-platform compatibility.

sync-mattpocock