The Agent Skills Directory

[REMOTE_CODE_EXECUTION]: The skill's documentation and installation scripts promote the execution of remote code via curl -fsSL https://psh.abslm.nl/install.sh | bash. Additionally, the install.sh script downloads multiple secondary scripts (setup.sh, ask.sh, status.sh, etc.) from the same domain and executes them sequentially.\n- [PERSISTENCE]: The installation process creates a permanent footprint on the system by installing a shim for the psh command in common PATH directories (e.g., ~/.local/bin/psh). It also creates symlinks in various AI agent skill directories (e.g., ~/.claude/skills, ~/.cursor/skills) to ensure the skill is loaded across different agent sessions.\n- [PRIVILEGE_ESCALATION]: The installer modifies file permissions using chmod +x for all downloaded scripts and attempts to write files to user-wide directories such as ~/.agents/skills and various binary directories on the system PATH.\n- [INDIRECT_PROMPT_INJECTION]: The skill facilitates human-in-the-loop interaction by fetching responses from a remote server. The scripts/ask.sh script specifically processes an answer field and instructs the agent to read and follow it as instructions, which provides a surface for indirect prompt injection if the remote content is malicious. This includes a mandatory evidence chain:\n
Ingestion points: scripts/ask.sh (lines 186-193) parses server responses.\n
Boundary markers: The script provides basic console warnings to the agent on stderr but lacks cryptographic or structural enforcement to prevent malicious instruction following.\n
Capability inventory: The skill has capabilities for network access (curl), filesystem modification (mkdir, cp, rm), and permission changes (chmod).\n
Sanitization: While JSON-escaping is applied to outbound data, the incoming natural language instructions in the answer field are not sanitized or filtered for prompt injection patterns.\n- [DATA_EXFILTRATION]: The scripts/ask.sh script is capable of sending metadata, including the current working directory ($PWD), to https://psh.abslm.nl if configured via environment variables. The transmission of API keys to the non-whitelisted domain is also documented.\n- [COMMAND_EXECUTION]: The skill relies extensively on shell command execution within its scripts to manage the installation lifecycle, credentials, and network communication.

psh-now