The Agent Skills Directory

[COMMAND_EXECUTION]: The fetchFromCli function in src/memorix.ts uses execSync to call the memorix CLI. The skillName parameter is taken from directory names found on the local filesystem and is interpolated into the command string without sanitization. An attacker who can create a directory with a malicious name (e.g., containing shell metacharacters) could achieve arbitrary command execution when the sync process runs.
Evidence: The skillName variable is directly interpolated into a command string passed to execSync in src/memorix.ts.
[EXTERNAL_DOWNLOADS]: The skill downloads content from the AVIDS2/memorix repository on GitHub. These downloaded files are written to the agent's skill directory (~/.agents/skills), effectively introducing external code into the agent's execution environment.
Evidence: Use of fetch to download repository contents from api.github.com and raw.githubusercontent.com in src/memorix.ts.
[INDIRECT_PROMPT_INJECTION]: The skill acts as a bridge for untrusted data, creating a surface for indirect prompt injection attacks by downloading and installing skills from unverified remote sources.
Ingestion points: Data is fetched from the GitHub API and local CLI outputs in src/memorix.ts.
Boundary markers: None; content is saved directly to skill files without delimiters or instructions for the agent to ignore embedded prompts.
Capability inventory: The skill possesses capabilities for command execution (execSync), filesystem writes (writeFileSync), and link creation (symlinkSync).
Sanitization: No sanitization or validation of the downloaded content is performed before storage.

sync-local-global-agents-skills