The Agent Skills Directory

[REMOTE_CODE_EXECUTION]: The setup instructions recommend executing a remote shell script via curl | bash, which is a high-severity security risk.
Evidence: curl -fsSL https://raw.githubusercontent.com/yvgude/lean-ctx/main/skills/lean-ctx/scripts/install.sh | bash in SKILL.md.
The source repository owner (yvgude) is not a recognized or trusted vendor, and the script's integrity is not verified before execution.
[COMMAND_EXECUTION]: The skill provides a mechanism to wrap and execute arbitrary shell commands using lean-ctx -c <command>.
This pattern allows for the execution of any system command, which can lead to privilege escalation or unauthorized system access if the input to the command is influenced by untrusted data.
[EXTERNAL_DOWNLOADS]: The skill depends on external resources for installation and setup without providing checksums or verification mechanisms.
References https://raw.githubusercontent.com/yvgude/lean-ctx/main/skills/lean-ctx/scripts/install.sh for primary installation.
[DATA_EXFILTRATION]: The tool is designed to read and compress sensitive information, including file contents and outputs from commands like aws, docker, and kubectl.
While intended for context compression, this functionality provides the necessary capabilities for harvesting and preparing sensitive data for exfiltration.
[PROMPT_INJECTION]: The skill processes untrusted data from external command outputs and local files, creating a surface for indirect prompt injection.
Ingestion points: File content ingestion via lean-ctx read and command output via lean-ctx -c.
Boundary markers: Absent. The skill does not use delimiters to distinguish between data and instructions when reading files or command results.
Capability inventory: Broad shell execution, file system reading, and network access (via curl support).
Sanitization: No evidence of sanitization, filtering, or escaping is present in the skill instructions.

lean-ctx