The Agent Skills Directory

[REMOTE_CODE_EXECUTION]: The documentation instructs users to install the tool by piping a remote shell script directly into the shell ('curl ... | sh') for macOS/Linux and a PowerShell script into 'iex' for Windows. These scripts are hosted on a repository (github.com/sysprog21/zhtw-mcp) that is not verified, allowing for unauthenticated remote code execution.
[PRIVILEGE_ESCALATION]: The provided Windows installation command uses the '-ExecutionPolicy Bypass' flag, which explicitly instructs the system to ignore local security restrictions to run the downloaded script.
[PERSISTENCE]: The skill encourages the creation of a git pre-commit hook ('.git/hooks/pre-commit') to automatically run the linter. This establishes a mechanism where code is automatically executed during standard development workflows.
[INDIRECT_PROMPT_INJECTION]: The 'zhtw' tool processes arbitrary text input. The documentation states that the tool 'uses the AI assistant itself to help decide context' for ambiguous terms. This creates an attack surface where malicious instructions embedded in the input text could influence the assistant's behavior. Evidence: 1. Ingestion: The 'text' parameter in the 'zhtw' tool accepts untrusted content. 2. Boundary markers: No delimiters or instructions to ignore embedded commands are present. 3. Capability inventory: Tool output influences assistant suggestions and logic. 4. Sanitization: No input validation or sanitization is described.
[COMMAND_EXECUTION]: The skill provides numerous shell commands for building, installing, and configuring MCP servers, which could lead to unauthorized system modifications if executed in a sensitive environment without proper oversight.

zhtw-mcp-linguistic-linter