The Agent Skills Directory

[REMOTE_CODE_EXECUTION]: The documentation includes a command to download and execute a script directly from the vendor's GitHub repository: curl -fsSL https://raw.githubusercontent.com/SupSub-AI/supsub-cli/master/scripts/install.sh | bash. This represents remote code execution triggered during the setup process.
[EXTERNAL_DOWNLOADS]: Recommends installing the @supsub/cli package from public registries using npm or pnpm to provide the necessary tooling for the skill.
[COMMAND_EXECUTION]: The skill's core functionality relies on executing shell commands through the supsub CLI to manage groups and list subscription sources.
[PROMPT_INJECTION]: The skill processes external data from the SupSub API, such as group names and source descriptions, creating an indirect prompt injection surface (Category 8).
Ingestion points: Metadata retrieved by supsub group list and supsub group subs as described in SKILL.md.
Boundary markers: There are no explicit boundary markers or instructions to the agent to ignore instructions embedded within the processed data.
Capability inventory: The agent has the capability to execute shell commands via the supsub CLI.
Sanitization: The instructions do not specify any sanitization or validation logic for the data retrieved from the API before it is processed by the agent.

supsub-group