The Agent Skills Directory

[COMMAND_EXECUTION]: The skill instructions in SKILL.md (Companion check section) direct the agent to execute a shell command (ls) to inspect hidden directories in the user's home path (~/.claude/skills/, ~/.agent/skills/, etc.) to identify installed companion skills.
[REMOTE_CODE_EXECUTION]: The skill contains instructions for the agent to suggest and potentially execute npx skills add commands. This involves downloading and executing packages from the npm registry, which constitutes a remote code execution vector.
[EXTERNAL_DOWNLOADS]: Both the primary installation instructions in README.md and the companion check logic in SKILL.md facilitate the download of external components through npx commands and references to external repositories.

employment-law