The Agent Skills Directory

[REMOTE_CODE_EXECUTION]: The skill instructs the agent to download and execute scripts directly from a remote repository by piping network output to a shell, a high-risk pattern for supply chain attacks.
Evidence: curl -fsSL https://raw.githubusercontent.com/Rheinmir/setup/orca/harness/poc-vendor-neutral/bootstrap.sh | bash
Evidence: git clone -q --depth 1 -b orca https://github.com/rheinmir/setup.git /tmp/llmwiki-tpl && bash /tmp/llmwiki-tpl/harness/scripts/install-harness.sh . --self-heal.
[COMMAND_EXECUTION]: The skill uses various shell commands and Python snippets to inspect the environment, project state, and template versions.
Evidence: python3 -c "import json;print(json.load(open('$HOME/.claude/harness/version.json')).get('template_version'))".
Evidence: Use of cat .llmwiki/.harness-stamp and head -3 CAPABILITIES.md to verify local state.
[DATA_EXFILTRATION]: The skill accesses and modifies highly sensitive configuration files associated with the agent's operation, which may contain environment secrets or identity configurations.
Evidence: The skill reads, modifies, and backups ~/.claude/settings.json.
[PERSISTENCE]: The skill establishes persistence by modifying persistent configuration files and project-level automation hooks.
Evidence: Overwrites .claude/settings.json and .pre-commit-config.yaml to include harness snippets.
Evidence: Instructs the re-generation of capability mappings using python3 ~/.claude/harness/hooks/build-capabilities.py.
[INDIRECT_PROMPT_INJECTION]: The skill ingests metadata from existing project files during the update and audit process, creating a surface for potential instruction injection.
Ingestion points: Metadata extraction from wiki pages in the llmwiki/ directory (e.g., ## Origin and frontmatter).
Boundary markers: None; the skill does not specify delimiters or instructions for the agent to ignore commands embedded within the wiki files.
Capability inventory: Significant capabilities including network access (curl, git), file system modification (rm, bash redirection), and script execution (bash, python3).
Sanitization: No evidence of sanitization or content validation for the metadata processed from external project files.
[DYNAMIC_EXECUTION]: The skill generates and executes code at runtime based on the success or failure of previous installation steps.
Evidence: The conditional execution of install-harness.sh after cloning from GitHub into /tmp.

dym-setup-maintain