The Agent Skills Directory

[EXTERNAL_DOWNLOADS]: The skill documentation directs users to download source code from an untrusted GitHub repository (chekusu/wanman) not listed as a trusted vendor, which constitutes a supply chain risk.
[REMOTE_CODE_EXECUTION]: The installation process involves cloning a remote repository and executing its contents using pnpm install, pnpm build, and subsequently running the generated bundles. This sequence of downloading and executing external code from an unknown source is a high-risk pattern.
[PERSISTENCE]: The skill instructs users to modify their shell configuration files (e.g., ~/.bashrc or ~/.zshrc) to add the built binaries to the system PATH. This allows the agent runtime to persist across user sessions and maintain execution capability.
[DYNAMIC_EXECUTION]: The tool generates a standalone JavaScript bundle (wanman.mjs) at build time and executes it via Node.js, representing the runtime execution of dynamically generated code.
[INDIRECT_PROMPT_INJECTION]: The wanman takeover command processes content from target git repositories. If these repositories contain malicious instructions formatted for agent consumption, they could influence the supervisor or individual agents to perform unauthorized actions.
Ingestion points: Reads files and structures from local git repositories being "taken over," and processes goals and messages provided via the CLI.
Boundary markers: The instructions lack definitions for delimiters or system instructions to ignore embedded prompts within the files being processed.
Capability inventory: The skill spawns child processes (Claude/Codex), performs file system writes (worktrees), and utilizes local network communication (JSON-RPC).
Sanitization: There is no evidence of filtering or sanitization logic to prevent instructions within the analyzed codebase from being treated as authoritative commands by the agent matrix.

wanman-agent-matrix