The Agent Skills Directory

[REMOTE_CODE_EXECUTION]: The skill instructions direct the agent to download an installation script from https://varlock.dev/install.sh and execute it using the shell (sh). Downloading and running code from an external, non-whitelisted domain is a high-risk pattern that can lead to arbitrary code execution.
[PERSISTENCE]: The skill recommends adding the tool's binary path to shell profile files (~/.zshrc or ~/.bashrc). Modifying user startup scripts is a persistence technique that ensures code is executed in all future terminal sessions, potentially allowing for long-term unauthorized access or environmental control.
[DYNAMIC_EXECUTION]: The schema documentation demonstrates the use of an exec() function within .env.schema files to retrieve secrets. This allows for the runtime execution of arbitrary shell commands (e.g., calling CLI tools for 1Password or AWS) whenever the configuration is loaded, creating a vector for command injection or unintended execution if the schema is manipulated.
[INDIRECT_PROMPT_INJECTION]: The skill manages sensitive data by processing external .env and .env.schema files. This creates an attack surface where an attacker-controlled file could potentially inject instructions or exploit the agent's capabilities, although the skill includes explicit 'Security Rules' to mitigate direct exposure.
[COMMAND_EXECUTION]: The installation process involves complex shell operations including directory creation (mktemp), cleanup traps, and direct execution of external payloads with specific flags (--force-no-brew), which are executed in the local environment context.

varlock