The Agent Skills Directory

[COMMAND_EXECUTION]: The skill recommends running an external PowerShell script (INSTALL-AIO.ps1 -Components codeburn ...) for installation. This script is not provided within the skill files, and its source is not explicitly defined, making its contents and safety unverifiable during static analysis.
[REMOTE_CODE_EXECUTION]: The skill instructions suggest running npx codeburn, which facilitates the execution of remote code by fetching and running the latest package from the NPM registry.
[EXTERNAL_DOWNLOADS]: The use of npx and the reference to an external installation script imply dependency on external, third-party resources from the getagentseal organization, which is not a pre-verified trusted vendor.
[INDIRECT_PROMPT_INJECTION]: The tool's core functionality involves reading and analyzing local AI session logs, which is an untrusted data source.
Ingestion points: Local session logs (referenced in SKILL.md).
Boundary markers: No specific delimiters or instructions to ignore embedded commands within logs are provided in the skill documentation.
Capability inventory: The tool includes an interactive TUI and a local web server (codeburn web).
Sanitization: There is no evidence of sanitization or filtering of log data before it is processed and presented in the UI.

codeburn