The Agent Skills Directory

[REMOTE_CODE_EXECUTION]: The skill provides instructions to download a shell script from https://varlock.dev/install.sh and execute it using the shell (sh). This 'curl | sh' pattern from an unverified source allows for arbitrary code execution on the user's machine.
[EXTERNAL_DOWNLOADS]: The skill relies on external resources from varlock.dev, a domain not associated with the author (sickn33) nor recognized as a trusted vendor. This poses a supply chain risk as the content of the remote script could be changed without notice.
[DYNAMIC_EXECUTION]: The .env.schema documentation demonstrates the use of exec() directives to retrieve secrets (e.g., API_KEY=exec('op read ...')). This allows the tool to run arbitrary shell commands specified in a configuration file, creating a path for command injection if the configuration file is untrusted.
[INDIRECT_PROMPT_INJECTION]: The skill processes external data from .env and .env.schema files.
Ingestion points: Reads .env.schema and .env files (SKILL.md).
Boundary markers: None present to distinguish between data and instructions.
Capability inventory: Uses curl, sh, and varlock run which spawns subprocesses.
Sanitization: No evidence of sanitization or validation of the commands within the exec() blocks or other configuration inputs.
[COMMAND_EXECUTION]: The skill involves multiple shell-level operations, including directory creation, script execution, and modifying the shell environment (PATH), which are necessary for the tool but increase the overall attack surface.

varlock