The Agent Skills Directory

[REMOTE_CODE_EXECUTION]: The skill provides a bash snippet that uses curl to fetch a remote installation script from https://raw.githubusercontent.com/ZhangHanDong/makepad-skills/main/install.sh and provides instructions for its execution via bash.
[EXTERNAL_DOWNLOADS]: Fetches executable content and configuration from an external GitHub repository not associated with verified or trusted vendors.
[PERSISTENCE]: The skill establishes persistence by modifying .claude/settings.json to install automated hooks. These hooks trigger the execution of shell scripts (makepad-skill-router.sh, pre-tool.sh, post-bash.sh) during core agent events such as UserPromptSubmit, PreToolUse, and PostToolUse.
[INDIRECT_PROMPT_INJECTION]: The 'Evolution' and 'Self-Correction' features create a large attack surface by instructing the agent to ingest data from its current environment (including untrusted source code, compiler errors, and external patterns) and use it to update or modify its own skill instructions.
Ingestion points: Reads project files, Cargo.toml, Cargo.lock, and tool error outputs to determine evolution steps (SKILL.md).
Boundary markers: Includes warnings to review scripts before execution and to keep updates within authorized scopes, but these do not prevent adversarial data from influencing the self-update logic.
Capability inventory: The skill has the capability to write to the file system, commit changes via git, and trigger automated shell scripts via hooks.
Sanitization: There is no explicit evidence of sanitization or validation of the untrusted data before it is incorporated into the skill library.

evolution