The Agent Skills Directory

[EXTERNAL_DOWNLOADS]: The skill fetches content from GitHub, which is a well-known service, to update local resources from a third-party repository (AVIDS2/memorix).\n- [COMMAND_EXECUTION]: The skill uses shell execution to interact with local CLI tools for metadata retrieval. Evidence: src/memorix.ts invokes execSync to run memorix skills show --name "${skillName}" --json.\n- [REMOTE_CODE_EXECUTION]: The skill downloads instruction files (SKILL.md) and other assets from a remote source and writes them into local skill directories. Because these files are interpreted and executed by the AI agent platform, a compromise of the remote repository could lead to the execution of malicious instructions. Evidence: The refreshSkill and writeSkillFiles functions in src/memorix.ts write downloaded buffers directly to the local filesystem using writeFileSync.\n- [DATA_EXFILTRATION]: The skill scans application-specific directories for Cursor, Codex, and Claude to locate existing skills. While this access is used for syncing, reading from internal application paths is a high-privilege operation. Evidence: src/memorix.ts contains hardcoded paths in LOCAL_SOURCE_CANDIDATES targeting user home directory application data for third-party AI agents.

sync-local-global-agents-skills