The Agent Skills Directory

[REMOTE_CODE_EXECUTION]: The skill provides instructions for the agent to execute a shell command that downloads and runs an external package at runtime, which can lead to unauthorized code execution.
Evidence: The references/workflow-cards.md file contains an implementation command: npm exec --yes --ignore-scripts --package=agentic-awesome-skills@16.7.0 -- agentic-awesome-skills --release 16.7.0 --path .agents/skills --skills brainstorming,systematic-debugging --dry-run.
Execution: The skill specifically directs the agent to repeat the command without the --dry-run flag to perform the actual installation of skills, granting the external package execution rights on the local system.
[EXTERNAL_DOWNLOADS]: The orchestration process relies on downloading the agentic-awesome-skills package from the public NPM registry, which is not a pre-verified or trusted source for this environment.
[INDIRECT_PROMPT_INJECTION]: The skill is designed to ingest and follow instructions from external files that may be influenced by third parties or malicious actors.
Ingestion Points: According to SKILL.md, the agent must read workflows from docs/users/workflows.md and data/workflows.json within the project environment.
Capability Inventory: The skill has the capability to execute shell commands, manage other skills, and modify the file system based on the instructions found in these files.
Boundary Markers: There are no explicit delimiters or instructions for the agent to ignore potentially malicious embedded commands within these external data files.
Sanitization: The instructions lack any requirement for validation, escaping, or filtering of the content retrieved from external workflow sources.
[DYNAMIC_EXECUTION]: The skill uses runtime-generated shell commands to install and manage the agent's operational capabilities.
Evidence: The use of npm exec to dynamically fetch and install skill dependencies into the .agents/skills directory as outlined in the handoff procedures.

antigravity-workflows