The Agent Skills Directory

[COMMAND_EXECUTION]: The skill instructs the agent to execute npm install and npm run displace (which runs tsx src/deploy.ts) autonomously in the background. It explicitly states "do this in the background; do not ask the user to run commands."
[REMOTE_CODE_EXECUTION]: The skill follows a pattern of generating local source code (src/deploy.ts) based on user-provided inputs and then executing that code. This dynamic code generation and execution increases the risk of command injection if inputs are not properly sanitized.
[CREDENTIALS_UNSAFE]: The skill is designed to handle sensitive authentication data. It prompts the user for the path to an SSH private key and then reads the content of that file into the deployment script: await mainAuth.key.data.set(await fs.promises.readFile(process.env.SSH_KEY!)). Additionally, it collects NAMECHEAP_API_KEY for DNS automation.
[PRIVILEGE_ESCALATION]: The deployment logic attempts to use root as the SSH user if the default ubuntu user fails, and specifies that the SSH user must have sudo/root privileges on the target servers.
[EXTERNAL_DOWNLOADS]: The skill triggers the download of the @taubyte/spore-drive SDK and other dependencies from the NPM registry via npm install during the autonomous deployment process.

spore-drive-sdk