The Agent Skills Directory

[REMOTE_CODE_EXECUTION]: The installation instructions for the skill utilize dangerous patterns such as curl | sh and irm | iex. These commands download and execute scripts directly from the vendor's servers (app.getdot.ai and eu.getdot.ai) to install the CLI component.
[EXTERNAL_DOWNLOADS]: The install.sh script downloads the compiled dot CLI binary from the vendor's GitHub repository. Additionally, the skill's core logic in src/ask.mjs downloads chart images and data files (PNG and CSV) from the vendor's API to the user's local temporary directory.
[PRIVILEGE_ESCALATION]: The install.sh script contains logic to use sudo for installing the binary into protected system directories like /usr/local/bin if the current user lacks the necessary write permissions.
[COMMAND_EXECUTION]: The skill relies on executing shell commands via the dot CLI to communicate with the data analyst service, manage workspace notes, and handle data catalog operations.
[INDIRECT_PROMPT_INJECTION]: The skill ingests data from the external Dot API, which includes natural language explanations and SQL results. This creates a surface for indirect prompt injection if the server-provided content were to contain malicious instructions.
Ingestion points: Data is received via the /api/agentic endpoint and processed for terminal output in src/ask.mjs and src/catalog.mjs.
Boundary markers: No explicit boundary markers or instructions to ignore embedded commands are present in the prompt templates used to interpolate API results.
Capability inventory: The skill can execute arbitrary shell commands via the dot CLI, write to the local file system (cache and temp files), and perform network operations.
Sanitization: Identifiers like chat_id are sanitized to prevent path traversal during file downloads, but the textual content of the analysis is presented without specific filtering or sanitization.

dot