The Agent Skills Directory

[EXTERNAL_DOWNLOADS]: The skill instructs the user to download and install executable code from an external repository at node.gitlawb.com and an NPM package under the @gitlawb scope. These locations are not recognized as trusted organizations or well-known development services, introducing a potential supply chain risk.
[COMMAND_EXECUTION]: The skill facilitates the use of high-privilege tools including Bash execution, FileWrite, and FileEdit. Since these tools are driven by a shim layer downloaded from an unknown external source, there is a risk that the logic could be modified to execute unauthorized commands on the host system.
[INDIRECT_PROMPT_INJECTION]: The skill possesses a significant attack surface for indirect injection.
Ingestion points: The skill utilizes WebFetch and WebSearch tools to ingest untrusted data from the internet into the agent's context.
Boundary markers: There are no explicit instructions or markers mentioned to delimit external data or prevent the agent from obeying instructions embedded within it.
Capability inventory: The skill maintains access to a powerful set of tools across its scripts, including Bash (shell execution), FileWrite/FileEdit (system modification), and Agent (sub-agent spawning).
Sanitization: No sanitization or validation mechanisms are described for the data retrieved from external sources before it is processed by the agent.
[CREDENTIALS_UNSAFE]: The skill documentation indicates that it automatically attempts to read sensitive credential files, specifically ~/.codex/auth.json, to authenticate with the Codex backend. Accessing hardcoded paths to local security tokens represents a potential data exposure risk.

openclaude-multi-llm