The Agent Skills Directory

[REMOTE_CODE_EXECUTION]: The skill instructs the agent to execute code from the npm registry using npx -y done-done-axi. While this is a documented feature of the vendor's toolset, it involves downloading and running code at runtime from a public registry.
[EXTERNAL_DOWNLOADS]: Fetches and executes the done-done-axi package from the npm registry as a fallback if the local done-done command is unavailable.
[DATA_EXFILTRATION]: The skill can transmit captured evidence (screenshots, recordings, and logs) to an external "sign-off board" using the --post flag. It also features a look command that visits arbitrary URLs, which could potentially be used for data transmission via query parameters or path segments.
[INDIRECT_PROMPT_INJECTION]: The skill possesses an attack surface for indirect injection by processing untrusted external data:
Ingestion points: Processes user-supplied arguments ($ARGUMENTS), Pull Request (PR) URLs, local report files, and captured application logs or transcripts.
Boundary markers: None identified. There are no explicit delimiters or instructions to ignore embedded commands within the processed data.
Capability inventory: Includes shell command execution via the done-done CLI, network access for status posting and URL capturing, and local file writing.
Sanitization: No evidence of input validation or sanitization for external content is provided.
[COMMAND_EXECUTION]: Relies on shell command execution for its primary operations, including command -v, npx, and various done-done subcommands which are influenced by user-provided arguments.
[DYNAMIC_EXECUTION]: The init command is designed to generate new AI skill files (SKILL.md) within the repository. The agent is instructed to read and follow these dynamically generated instructions, which could lead to unexpected behavior if the generation logic is compromised.

done-done