The Agent Skills Directory

[COMMAND_EXECUTION]: The SKILL.md file contains a 'Companion check' section that instructs the agent to automatically run a shell command (ls) targeting several sensitive paths in the user's home directory (e.g., ~/.claude/skills/, ~/.agent/skills/) to identify other installed skills.
[EXTERNAL_DOWNLOADS]: The installation instructions in README.md and SKILL.md promote the use of npx skills add AbsolutelySkilled/AbsolutelySkilled, which downloads and executes scripts from an external, untrusted GitHub repository.
[DATA_EXFILTRATION]: The automated directory probing allows the agent to harvest information about the user's local environment, specifically the list of installed AI agent skills, which constitutes a privacy risk.
[REMOTE_CODE_EXECUTION]: The skill utilizes npx for various tasks such as npx create-video@latest and npx remotion studio, which execute code from remote packages during the development workflow.

remotion-video