The Agent Skills Directory

[EXTERNAL_DOWNLOADS]: The skill instructs users to download and install pre-compiled binaries (cc-connect-linux-amd64, cc-connect-darwin-arm64) from a personal GitHub repository (chenhg5/cc-connect) rather than a verified organization or official vendor repository.
[COMMAND_EXECUTION]: The skill provides a /shell <cmd> command intended for administration, which allows for the remote execution of arbitrary shell commands on the host machine via messaging platforms like Telegram or Slack.
[REMOTE_CODE_EXECUTION]: The 'Quick AI-assisted Setup' section includes a prompt directing the AI agent to fetch and follow instructions from a remote source (https://raw.githubusercontent.com/chenhg5/cc-connect/refs/heads/main/INSTALL.md). This pattern can be exploited to trick the agent into executing arbitrary malicious code or commands at runtime.
[PRIVILEGE_ESCALATION]: The installation instructions require the use of sudo to move unverified binaries into system-wide executable paths (/usr/local/bin/), which can grant the software elevated permissions.
[PERSISTENCE]: The skill features a /cron command allowing for the scheduling of recurring tasks, which can be used to establish persistence by repeatedly executing shell commands or scripts at specified intervals.
[INDIRECT_PROMPT_INJECTION]: The bridge architecture creates a significant attack surface for indirect prompt injection. Untrusted input from messaging platforms is passed directly to a local agent that has high-privilege capabilities such as shell access and file manipulation. While an admin_from check is mentioned, the lack of explicit instruction delimitation or sanitization before passing input to the agent increases the risk of command injection or malicious instruction execution.
Ingestion points: Messaging platform messages (Telegram, Slack, Discord, etc.) are ingested by the cc-connect process and forwarded to the local AI agent.
Boundary markers: None explicitly documented for protecting the AI agent from untrusted platform input.
Capability inventory: The skill provides /shell command execution, /cron scheduling, and file system access via the connected agent's working directory.
Sanitization: The skill relies on a user ID check (admin_from) but does not describe sanitization of the content sent to the agent.

cc-connect-ai-bridge