The Agent Skills Directory

[EXTERNAL_DOWNLOADS]: The skill downloads content from an untrusted third-party GitHub repository (AVIDS2/memorix) via the GitHub API and raw content delivery networks.
Evidence: fetchFromGitHub and fetchTree functions in src/memorix.ts target https://api.github.com/repos/AVIDS2/memorix/contents/... and raw.githubusercontent.com.
[REMOTE_CODE_EXECUTION]: The skill implements a 'download then execute' pattern by fetching files from a remote repository and writing them directly into the agent's skill directories (~/.agents/skills). Since AI agent skills typically contain instructions or scripts that are executed by the platform, this allows a remote repository to influence or execute code on the local machine.
Evidence: writeSkillFiles in src/memorix.ts writes buffers obtained from the network to the local filesystem without validation or sandboxing.
[COMMAND_EXECUTION]: The skill utilizes powerful system commands to manipulate the filesystem and execute external CLI tools. It modifies directories for multiple applications including WorkBuddy, QoderWork, Kimi Work, and CodeBuddy.
Evidence: fetchFromCli in src/memorix.ts uses execSync to call the memorix CLI with dynamic arguments.
Evidence: createDirLink in src/sync.ts and the fallback scripts (fallback/sync.ps1, fallback/sync.sh) use symlinkSync, mklink /J, and ln -s to create filesystem links across sensitive application paths.
[DYNAMIC_EXECUTION]: The skill dynamically generates filesystem structures and link mappings based on a hardcoded list of platforms, replacing existing directories with links to the downloaded content.
Evidence: syncPlatform in src/sync.ts deletes existing directories and replaces them with symbolic links to the central skills directory.
[INDIRECT_PROMPT_INJECTION]: The skill ingests data from a remote source that is subsequently used as a source of instructions for an AI agent, creating a surface for indirect prompt injection if the remote repository is compromised.
Ingestion points: GitHub repository AVIDS2/memorix (via src/memorix.ts).
Boundary markers: None present; files are written verbatim to the skill directory.
Capability inventory: Filesystem write, command execution (execSync), and symbolic link creation.
Sanitization: No evidence of validation, sanitization, or integrity checks (other than SHA comparison for versioning) for the downloaded content.

sync-local-global-agents-skills