The Agent Skills Directory

[EXTERNAL_DOWNLOADS]: The skill provides instructions to download a binary executable directly from a GitHub repository ('mikf/gallery-dl') using curl. This repository is not part of the trusted vendor list, and no checksum or signature verification is performed.
[REMOTE_CODE_EXECUTION]: By instructing the agent to download a remote binary and subsequently apply 'chmod +x' to make it executable, the skill establishes a high-risk pattern for remote code execution of unverified software.
[COMMAND_EXECUTION]: The skill uses the 'chmod' command to escalate the privileges of a downloaded file. Additionally, the 'exec' post-processor example demonstrates shell command execution using placeholders like '{_path}'. This creates a vulnerability surface where attacker-controlled file names could lead to command injection if the underlying tool does not adequately sanitize the inputs.
[CREDENTIALS_UNSAFE]: The documentation includes examples of passing plain-text passwords as command-line arguments, which exposes them in process trees and shell history. Furthermore, it details how to extract sensitive session cookies directly from browser profile databases using the '--cookies-from-browser' flag.

gallery-dl