The Agent Skills Directory

[REMOTE_CODE_EXECUTION]: The skill provides instructions to install software by piping a remote shell script directly into bash. This is a high-risk pattern that allows for arbitrary code execution without prior inspection.
Evidence: curl -fsSL https://github.com/SaladDay/cc-switch-cli/releases/latest/download/install.sh | bash in SKILL.md.
[EXTERNAL_DOWNLOADS]: The skill downloads binaries and scripts from a GitHub repository (SaladDay/cc-switch-cli) that is not associated with a known trusted organization or the skill's authoring vendor.
Evidence: Multiple curl -LO and curl -fsSL commands targeting github.com/SaladDay/cc-switch-cli/releases.
[PRIVILEGE_ESCALATION]: Manual installation and build instructions require the use of sudo to move or copy binaries into system directories, which grants the process administrative rights over the host system.
Evidence: sudo mv cc-switch /usr/local/bin/ and sudo cp target/release/cc-switch /usr/local/bin/ in SKILL.md.
[COMMAND_EXECUTION]: The skill facilitates the execution of various system commands, including xattr to remove security attributes and chmod to modify file permissions.
Evidence: chmod +x cc-switch and xattr -cr /usr/local/bin/cc-switch in SKILL.md.
[INDIRECT_PROMPT_INJECTION]: The skill possesses a broad attack surface for indirect injection as it ingests data from external API providers, MCP servers, and community repositories while having the capability to modify critical agent configuration files.
Ingestion points: Community skills discovered via cc-switch skills discover and remote provider model lists fetched via cc-switch provider fetch-models.
Boundary markers: None present; the instructions do not include delimiters or warnings for the agent to ignore instructions embedded in the external content it processes.
Capability inventory: The skill can write to filesystem paths (e.g., ~/.claude/CLAUDE.md), execute shell commands via mcp validate, and perform network operations via curl and proxy start.
Sanitization: No evidence of sanitization or validation of content fetched from remote skills or providers before it is synced to the agent's active configuration files.

cc-switch-cli