The Agent Skills Directory

[REMOTE_CODE_EXECUTION]: The preflight script in SKILL.md automatically installs the agent-reach CLI from a remote GitHub archive (https://github.com/Panniantong/agent-reach/archive/main.zip) using pipx if it is not detected on the system. It also performs automated upgrades, which allows for remote code updates from an untrusted third-party source.
[EXTERNAL_DOWNLOADS]: The skill downloads and installs several dependencies from unverified sources, including a Weibo MCP server directly from a git repository (https://github.com/Panniantong/mcp-server-weibo.git) and multiple CLI tools via pipx (xiaohongshu-cli, twitter-cli, bilibili-cli, rdt-cli).
[CREDENTIALS_UNSAFE]: The skill provides instructions and commands for the agent to manage sensitive authentication data, including Twitter cookies and Groq API keys. Most notably, it includes a command to extract all cookies from the user's browser (agent-reach configure --from-browser chrome), presenting a high risk of unauthorized access to sensitive account information.
[COMMAND_EXECUTION]: The preflight script in SKILL.md fetches version data from the GitHub API and pipes it directly into a python3 command for parsing. While specific to JSON parsing, piping remote content into an interpreter is a risky execution pattern.
[INDIRECT_PROMPT_INJECTION]: The skill's primary function is to read and process data from untrusted external platforms such as LinkedIn, Twitter, Reddit, and various web articles.
Ingestion points: External data enters the agent context through xhs search, rdt read, yt-dlp, jina.ai, and various platform-specific MCP tool calls.
Boundary markers: There are no instructions provided to the agent to treat fetched content as untrusted or to ignore instructions embedded within the data.
Capability inventory: The agent possesses Bash, Write, and Edit capabilities, which could be exploited if malicious instructions are processed from a web page or social media post.
Sanitization: There is no evidence of sanitization or validation of the external content before it is interpolated into the agent's context.

agent-reach