The Agent Skills Directory

[EXTERNAL_DOWNLOADS]: The skill is designed to fetch content from external GitHub repositories, specifically 'mattpocock/skills' and 'awesome-skills/code-review-skill', using the GitHub API.
[COMMAND_EXECUTION]: The provided scripts scripts/check.py and scripts/apply.py utilize the subprocess module to execute the gh (GitHub CLI) command for authentication checks and repository interactions.
[REMOTE_CODE_EXECUTION]: The skill facilitates the download and local installation of external scripts and instructions (SKILL.md files and Python scripts). While it requires interactive user confirmation to apply changes, it serves as a mechanism for delivering and writing executable content from remote sources to the local filesystem.
[PROMPT_INJECTION]: The skill presents a surface for indirect prompt injection. Malicious instructions placed in the upstream repositories could be synchronized into the local environment, potentially overriding agent behavior in future sessions. The skill includes a diff summary and interactive confirmation ('y/n/file-by-file') as a mitigation measure for manual review.
[DATA_EXFILTRATION]: The skill has the capability to read local files for diffing purposes and write new files. It communicates with GitHub via the gh tool. The analysis did not find evidence of exfiltrating sensitive system files or credentials (like SSH keys or environment variables) outside of the synchronization scope.

rc-skill-updater