The Agent Skills Directory

[EXTERNAL_DOWNLOADS]: The skill instructs the user to clone source code from a third-party GitHub repository (https://github.com/qwen-code-dev-bot/oh-my-cli.git) that does not belong to a recognized trusted organization. This introduces a dependency on unverified external code during the installation process.
[COMMAND_EXECUTION]: The agent is equipped with a execute_command tool, granting it the capability to run arbitrary shell commands on the host system. While the skill documentation mentions "approval gates," the inherent power of this tool represents a high-risk capability that could be abused if the agent's instructions are compromised.
[INDIRECT_PROMPT_INJECTION]: The skill describes an autonomous workflow where the agent ingests untrusted data from the local environment and acts upon it.
Ingestion points: The agent reads project files (read_file) and directory listings (list_directory) which may contain instructions from external contributors or malicious sources.
Boundary markers: The instructions do not define clear delimiters or system-level warnings to prevent the agent from mistakenly following commands embedded within the files it analyzes.
Capability inventory: The agent possesses high-impact tools including write_file, create_directory, and execute_command, allowing for significant system modifications.
Sanitization: There are no documented mechanisms for sanitizing or filtering the content of files before they are processed by the LLM.

oh-my-cli-autonomous-code-agent