The Agent Skills Directory

[REMOTE_CODE_EXECUTION]: The skill provides commands to download and immediately execute scripts from an untrusted source (higress.ai).
Evidence: bash <(curl -sSL https://higress.ai/hiclaw/install.sh) in the installation section for macOS/Linux.
Evidence: iex $wc.DownloadString('https://higress.ai/hiclaw/install.ps1') in the PowerShell installation section for Windows.
[EXTERNAL_DOWNLOADS]: The skill fetches resources and helm charts from various untrusted domains.
Evidence: helm repo add higress.io https://higress.io/helm-charts downloads Kubernetes charts.
Evidence: Pulling worker skills from https://skills.sh or http://nacos:8848/nacos at runtime.
[DYNAMIC_EXECUTION]: The skill configures workers to download and execute Node.js packages at runtime using npx -y, bypassing user confirmation.
Evidence: @modelcontextprotocol/server-filesystem, @modelcontextprotocol/server-git, and @modelcontextprotocol/server-postgres are executed via npx within the Worker and MCP server definitions.
Evidence: Support for the hermes runtime, which is described as being for "autonomous code execution."
[INDIRECT_PROMPT_INJECTION]: The architecture relies on ingesting messages from Matrix rooms to coordinate agent actions, creating a surface for indirect instructions to influence the manager and workers.
Ingestion points: Matrix communication rooms where Manager, Workers, and Humans collaborate (SKILL.md).
Boundary markers: Absent. No specific delimiters or safety warnings are provided to prevent the agent from obeying instructions embedded in room messages.
Capability inventory: Resource management via hiclaw apply/delete (affecting K8s/Docker), Helm deployment, and autonomous code execution capabilities in workers (SKILL.md).
Sanitization: Absent. There is no mention of filtering or escaping external content from the Matrix interface.
[PRIVILEGE_ESCALATION]: The Windows installation instructions attempt to bypass existing security policies.
Evidence: Set-ExecutionPolicy Bypass -Scope Process -Force is used in the PowerShell script to allow execution of downloaded code.
[METADATA_POISONING]: There is a discrepancy between the stated author in the documentation and the authoritative vendor record.
Evidence: The skill claims to be by "ara.so", which conflicts with the verified author "reason-machines".

hiclaw-multi-agent-orchestration