The Agent Skills Directory

[REMOTE_CODE_EXECUTION]: The SKILL.md file provides a terminal installation command using curl -fsSL ... | sh. This piped remote execution pattern downloads a shell script from the author's GitHub repository and executes it immediately, which bypasses local review and verification of the code.
[REMOTE_CODE_EXECUTION]: The onboard.py engine is designed to clone external git repositories specified in an organizational manifest and execute installer scripts (e.g., install.sh) found within them. This allows the execution of code from remote sources defined solely in configuration files.
[DYNAMIC_EXECUTION]: The script extensively uses subprocess.run to execute system commands, including git and AI client binaries. While necessary for its purpose, this broad execution capability provides a significant attack surface if input parameters from manifests are not strictly controlled.
[PERSISTENCE_MECHANISMS]: The skill installs native plugins for AI agents (Claude and Codex) that remain active across sessions. This ensures that the skill's logic and tools are persistently available in the agent's operational environment.
[INDIRECT_PROMPT_INJECTION]: The skill ingests data from external YAML manifests, specifically the welcome and try_asking fields, and interpolates them into AGENTS.md and CLAUDE.md files without sanitization. As these files are used by AI agents to establish workspace context, this lack of escaping creates a surface for indirect prompt injection if the manifest source is compromised.
Ingestion points: Manifest files provided via the --manifest argument and parsed by load_manifest in onboard.py.
Boundary markers: Generated markdown files include generator metadata comments but lack protective delimiters or instructions to ignore embedded content.
Capability inventory: The skill has broad capabilities for network access, file system modification, and shell command execution.
Sanitization: There is no evidence of string sanitization or validation for text extracted from the manifest before it is written to the agent's context files.

synthesis-onboarding