The Agent Skills Directory

[EXTERNAL_DOWNLOADS]: The skill instructions provide a command to fetch a remote file from an unverified source.
Evidence: curl -fsS https://viboscope.com/api/v1/skill -o viboscope.md in SKILL.md.
[REMOTE_CODE_EXECUTION]: The skill encourages the agent to 'Install Viboscope' by downloading a markdown file. In the context of AI agents, markdown files contain the instructional logic the agent follows; fetching these from an unverified remote source is equivalent to executing untrusted remote code.
Evidence: 'Tell your AI agent: "Install Viboscope and find me a cofounder"' combined with the installation command.
[INDIRECT_PROMPT_INJECTION]: The skill creates a significant attack surface by ingesting external data that is intended to govern agent behavior.
Ingestion points: viboscope.md downloaded via curl.
Boundary markers: The skill advises saving outside active directories for review, but the examples explicitly tell the user to command the agent to 'Install' it, which likely bypasses manual review.
Capability inventory: The skill claims to perform profiling and searching, which may involve further network or tool access once the external instructions are loaded.
Sanitization: None detected; the agent is expected to follow the instructions provided by the remote endpoint.

viboscope