The Agent Skills Directory

[REMOTE_CODE_EXECUTION]: The skill instructs the agent to download and execute shell scripts from a remote GitHub repository belonging to the author (github.com/Rheinmir). Patterns detected include:
Piping curl output directly to bash: curl -fsSL https://raw.githubusercontent.com/Rheinmir/setup/orca/harness/poc-vendor-neutral/bootstrap.sh | bash.
Using bash process substitution for remote scripts: bash <(curl -fsSL https://raw.githubusercontent.com/Rheinmir/setup/orca/fdk/tools/fdk-kit.sh) pull.
[PERSISTENCE]: The skill modifies the agent's global execution environment and configuration across sessions. Evidence includes:
Modifying the global agent configuration file ~/.claude/settings.json to install custom "hooks" and permissions.
Installing an "engine global" in ~/.claude/harness/ and global skills in ~/.claude/skills/ via npx skills add.
[COMMAND_EXECUTION]: Extensive use of shell commands to interact with the system, including cloning repositories, running installers, and executing tool commands to verify their behavior.
[INDIRECT_PROMPT_INJECTION]: The skill has a significant attack surface for indirect prompt injection as it is designed to ingest and process external, untrusted repositories.
Ingestion points: External repository URLs and local clones.
Boundary markers: The instructions mention using a "sandbox" and "scope pin" (e.g., isolated HOME directory), which act as mitigations but do not fully eliminate the risk of the agent following instructions embedded in a malicious repo's manifest or documentation.
Capability inventory: The skill uses bash, python, and npx to execute commands derived from the external tools it explores.
Sanitization: The skill prioritizes reading manifest files (e.g., package.json) over prose documentation to verify valid commands, but it still executes --help and other commands from the untrusted tool to verify exit codes.

doyourmagic