The Agent Skills Directory

[REMOTE_CODE_EXECUTION]: The README.md file includes a command to download and execute an installation script from an external repository using a highly risky pattern: curl -fsSL https://raw.githubusercontent.com/openprose/mycelium/main/install.sh | bash. This allows the remote server to execute arbitrary commands in the user's environment without prior review.
[COMMAND_EXECUTION]: The skill requires the execution of an external shell script, mycelium.sh, for its core functionality. It also instructs the user to configure 'hooks' that execute scripts from the ~/.claude/hooks/ directory, which could lead to persistent execution of external code during the agent's operation.
[INDIRECT_PROMPT_INJECTION]: The skill is designed to read 'notes' attached to git objects, which are external data sources that may be controlled by third parties (e.g., in shared repositories).
Ingestion points: Content is ingested through commands like mycelium.sh context <file> and mycelium.sh find constraint (referenced in SKILL.md and README.md).
Boundary markers: There are no instructions provided to the agent to treat this ingested content as untrusted or to use delimiters to separate it from its system instructions.
Capability inventory: The skill provides the agent with capabilities to execute shell commands, modify git notes, and potentially interact with the file system based on instructions found in the notes.
Sanitization: There is no mention of sanitization or validation of the content retrieved from git notes before it is placed into the agent's context.

mycelium