The Agent Skills Directory

[REMOTE_CODE_EXECUTION]: The skill explicitly recommends and implements a pattern for executing remote scripts piped directly to a shell. Specifically, the script scripts/upgrade_ai_clis.py and the SKILL.md documentation suggest the command curl -fsSL https://opencode.ai/install | bash for the OpenCode tool. Executing unverified code from third-party domains via piped shell commands is a critical security risk.
[COMMAND_EXECUTION]: The script scripts/upgrade_ai_clis.py executes arbitrary shell commands provided in the CURSOR_UPGRADE_CMD environment variable using subprocess.run(["bash", "-lc", cursor_cmd]). This provides a mechanism for arbitrary command execution if the environment or the skill's configuration file is influenced by an attacker.
[EXTERNAL_DOWNLOADS]: The skill downloads and executes installer scripts from official sources. It fetches the Antigravity installer from https://antigravity.google/cli/install.sh and references the Codex installer at https://chatgpt.com/codex/install.sh. While these originate from trusted organizations (Google and OpenAI), they contribute to the skill's capability for remote code execution.
[DATA_EXFILTRATION]: The configuration loading logic in scripts/upgrade_ai_clis.py utilizes os.expandvars when parsing the config.yml file. This behavior can lead to the unintended expansion and potential exposure of sensitive environment variables if the configuration file content is manipulated.
[PROMPT_INJECTION]: The skill exhibits an indirect prompt injection surface where untrusted configuration data can influence executable logic. Evidence: 1. Ingestion points: config.yml parsed at runtime into shell commands. 2. Boundary markers: Absent. 3. Capability inventory: Shell command execution via subprocess.run, network access via curl, and file system access. 4. Sanitization: Absent, as configuration values are directly interpolated into shell commands without validation.

soia-env-ai-cli-upgrade