The Agent Skills Directory

[REMOTE_CODE_EXECUTION]: The installation and uninstallation instructions direct users to pipe remote content directly into shell interpreters. This includes using bash <(curl ...) for macOS/Linux and Invoke-Expression (iex) for Windows PowerShell to execute scripts from higress.ai and githubusercontent.com without prior review.
[PRIVILEGE_ESCALATION]: The PowerShell installation instructions explicitly include the command Set-ExecutionPolicy Bypass -Scope Process -Force. This command is designed to override and disable system security protections that prevent the execution of unsigned or untrusted scripts.
[EXTERNAL_DOWNLOADS]: The skill downloads installers, Helm charts, and AI worker configurations from external domains such as higress.ai and higress.io. It also includes functionality to pull community-contributed AI skills from https://skills.sh at runtime.
[COMMAND_EXECUTION]: The instructions utilize various system tools that can execute arbitrary logic, including npx for running Node.js packages, kubectl for modifying Kubernetes cluster states, and helm for installing software packages.
[INDIRECT_PROMPT_INJECTION]: The Manager-Workers architecture described creates a persistent surface for indirect injection attacks.
Ingestion points: Agents ingest data from collaborative Matrix chat rooms, shared MinIO storage buckets, and the remote Nacos skill registry.
Boundary markers: The skill lacks documentation or implementation of delimiters or instructions to ignore embedded commands when agents process data from these shared sources.
Capability inventory: Agents have access to the file system, network APIs, and the ability to deploy resources into Kubernetes clusters via kubectl and npx.
Sanitization: There is no evidence of input validation or output sanitization when agents communicate or share files across the shared runtime environment.

hiclaw-multi-agent-collaboration