The Agent Skills Directory

[REMOTE_CODE_EXECUTION]: The skill's operational flow requires the agent to execute a shell script (install.sh) found within the root of managed repositories. This script is described as a 'bootstrap/fallback installer' and is executed during updates. Running unvetted scripts from external sources allows for arbitrary code execution.
[COMMAND_EXECUTION]: The skill utilizes several system commands to perform its functions, including git clone, git pull, git push, git status, and git diff. These are used to synchronize content between local target directories (e.g., ~/.claude/skills/) and remote repositories.
[DATA_EXFILTRATION]: The 'Source Update Protocol' mandates pushing all local changes to configured git remotes. This functionality, while intended for synchronization, serves as a vector for transmitting local data to external servers.
[PROMPT_INJECTION]: The skill processes SKILL.md files from external repositories as its primary data source. This creates an indirect prompt injection surface where malicious content in an ingested file could manipulate the agent's behavior during the 'synthesis merge' or after the skill is installed.
Ingestion points: Reads SKILL.md files from various git repositories (public, personal, and shared).
Boundary markers: No specific delimiters or safety instructions are used to isolate the instructions contained within the ingested files.
Capability inventory: The agent has the ability to execute shell scripts (install.sh), perform git network operations, and write to multiple system directories.
Sanitization: The skill lacks validation or sanitization of the content it reads and merges into the agent's active instruction set.

synthesis-skills-manager