The Agent Skills Directory

[EXTERNAL_DOWNLOADS]: The skill instructions prompt the user to clone a repository from https://github.com/JCarterJohnson/vibecoded-design-tells.git. This repository is not associated with the stated skill author or any trusted vendor.
[REMOTE_CODE_EXECUTION]: The skill follows a download-and-execute pattern by instructing the user to clone an external repository and immediately run multiple Python scripts (collect.py, harvest.py, analyze.py, devibe_scan.py) and install unverified dependencies via pip install -r requirements.txt.
[COMMAND_EXECUTION]: The skill utilizes several shell commands to set up its environment and execute scanners, including git clone, pip install, and unzip. It specifically instructs the unzipping of skill files into the ~/.claude/skills/ directory, which modifies the environment of the AI agent.
[INDIRECT_PROMPT_INJECTION]: The skill possesses an ingestion surface for untrusted data from external APIs and local project files.
Ingestion points: Fetches data from the arctic-shift.photon-reddit.com API and reads local codebase files through the scan_file function.
Boundary markers: None identified in the provided script logic to delimit external data from instructions.
Capability inventory: The skill scripts can perform network requests (urllib.request), read files, and are intended to be integrated into CI/CD pipelines.
Sanitization: No explicit sanitization or validation of the ingested Reddit content is observed before processing.

vibecoded-design-tells-analysis