The Agent Skills Directory

[REMOTE_CODE_EXECUTION]: The skill requires cloning a repository from an unknown third-party source (https://github.com/calesthio/Crucix.git) and executing the contained scripts.
Evidence includes the installation steps: git clone, npm install, and running scripts like server.mjs and diag.mjs directly with Node.js.
The diag.mjs script is specifically highlighted for troubleshooting, which could potentially be used for system reconnaissance under the guise of diagnostics.
[EXTERNAL_DOWNLOADS]: The skill downloads project code and dependencies from non-whitelisted external sources.
Target: https://github.com/calesthio/Crucix.git.
[COMMAND_EXECUTION]: The skill executes multiple shell commands to set up the environment, including git, npm, node, and docker compose.
[INDIRECT_PROMPT_INJECTION]: The dashboard aggregates data from 27 external OSINT sources and processes them using an LLM to generate alerts and trade ideas, creating a vulnerability where malicious input in those sources could override agent instructions.
Ingestion points: 27 external data feeds including NASA satellite data, maritime tracking, flight tracking, radiation monitors (Safecast/RadNet), conflict data (ACLED), and 17 public Telegram intelligence channels.
Boundary markers: None identified; instructions do not specify delimiters or warnings for the LLM to ignore instructions embedded in the OSINT data.
Capability inventory: The skill can perform LLM-enhanced analysis, push alerts to Telegram and Discord, write sweep data to the local file system (./runs/), and potentially interact with financial accounts via Alpaca API keys.
Sanitization: None identified; the skill normailizes data but there is no mention of filtering or escaping content to prevent prompt injection from the OSINT sources.
[SAFE]: The skill uses the official @openai/codex package for authentication via npx, which is an expected operation for the described functionality.

crucix-intelligence-dashboard