The Agent Skills Directory

[REMOTE_CODE_EXECUTION]: The runner script scripts/run.sh downloads platform-specific binaries from a non-vendor GitHub repository (runkids/skillshare) and executes them. The file also contains documentation suggesting that users download and pipe the script directly into a shell environment (curl | sh).
[PROMPT_INJECTION]: The SKILL.md file defines 'AI Caller Rules' that explicitly instruct the agent to use the --force and --skip-audit flags. This guidance teaches the agent how to circumvent the tool's built-in security auditing mechanisms when critical vulnerabilities are detected during installation or updates.
[COMMAND_EXECUTION]: The skill relies on extensive shell command execution for its core functionality, including managing file system symlinks, performing Git operations, and synchronizing directories across sensitive system paths like ~/.config/ and project roots.
[DATA_EXFILTRATION]: The skill provides a push command designed to transmit the contents of the local skill source directory and its associated configurations to remote Git repositories, which could be leveraged to exfiltrate data.
[PROMPT_INJECTION]: The skill facilitates the ingestion of untrusted data by installing and synchronizing content from arbitrary remote URLs and local directories, creating an attack surface for indirect prompt injection.
Ingestion points: The install and update commands pull external SKILL.md files and associated scripts from remote repositories into the agent's environment.
Boundary markers: Although an audit system is described, the skill's own instructions encourage bypassing these boundaries.
Capability inventory: The skill possesses the ability to execute binaries and perform extensive file system modifications.
Sanitization: There is no evidence of input validation or sanitization for content retrieved from external URLs before it is processed or synced.

skillshare