The Agent Skills Directory

[EXTERNAL_DOWNLOADS]: The skill instructs the agent to install several external third-party packages at runtime using pip3 and npm. These include git-dumper, ds_store, source-map-explorer, and unwebpack-sourcemap. These dependencies are not pinned to specific versions and are fetched from public registries.
[COMMAND_EXECUTION]: The skill relies extensively on complex shell scripts and pipes to perform its core functions. It uses curl to probe remote targets and local shell utilities like grep, sed, and xxd to process the results.
[DYNAMIC_EXECUTION]: Multiple instances of inline Python scripts (python3 -c) are used to parse JSON data from Swagger/OpenAPI files and to extract filenames from .DS_Store files. This involves executing dynamically generated strings of code.
[REMOTE_CODE_EXECUTION]: The skill contains a pattern where remote data fetched via curl is piped directly into the python3 interpreter (using the -m json.tool module). While this specific usage is intended for data formatting, the pattern of piping remote content into an interpreter is a significant security concern.
[INDIRECT_PROMPT_INJECTION]:
Ingestion points: The skill fetches untrusted content (JSON manifests, environment files, .git metadata) from external, user-defined target URLs in almost every phase of its operation.
Boundary markers: The skill lacks explicit delimiters or instructions to the agent to treat the fetched content as data rather than instructions, although it does include a general warning to treat downloaded text as untrusted.
Capability inventory: The skill possesses extensive capabilities including package installation (pip3/npm), file system writes to /tmp, and execution of complex shell pipes.
Sanitization: There is no evidence of sanitization or filtering of the content retrieved from the remote targets before it is processed by shell tools or Python scripts.

hunt-source-leak