The Agent Skills Directory

[EXTERNAL_DOWNLOADS]: The skill utilizes npx bird within the references/customer-signal-rubric.md file to perform searches for market signals. This pattern results in the dynamic download and execution of a package from the npm registry at runtime.
[REMOTE_CODE_EXECUTION]: Executing npx bird constitutes remote code execution, as the agent fetches and runs code from the public npm repository without pinned versions or integrity checks in the provided instructions.
[COMMAND_EXECUTION]: The SKILL.md file contains multiple bash code blocks intended for agent execution. These scripts perform system environment checks using uname, manage directory structures, and interact with hidden files in the ~/.superstack/ directory.
[DATA_EXFILTRATION]: The skill implements a telemetry mechanism that transmits system metadata (OS platform, hardware architecture) and skill usage events to an external server via curl. The destination URL is dynamically extracted from a local configuration file (~/.superstack/config.json) during the skill's preamble.
[PROMPT_INJECTION]: The skill ingests untrusted data from .superstack/idea-context.md (Workflow Step 1) and interpolates it into the analysis process. The absence of clear boundary markers or sanitization for this external content represents a surface for indirect prompt injection, where malicious instructions in the idea description could attempt to influence the agent's logic or abuse its available capabilities (like command execution or network access).

validate-idea