The Agent Skills Directory

[PRIVILEGE_ESCALATION]: The skill provides detailed instructions to the AI agent on how to circumvent platform-level security filters (scout-block hooks or sandbox denylists) that monitor for sensitive file path segments like .cache. It explicitly advises resolving paths into shell variables so the "literal string never appears" to the monitoring harness or moving the cache to an "unguarded" directory to evade detection.
[EXTERNAL_DOWNLOADS]: The skill performs automated network operations using git clone and git pull to fetch external data from a third-party repository (https://github.com/nexu-io/open-design.git). While these are template assets, they originate from a source that is not verified as a trusted vendor.
[COMMAND_EXECUTION]: The instructions suggest that the agent install an external tool qmd globally using bun install -g https://github.com/tobi/qmd. Installing and executing binaries from unverified third-party GitHub accounts introduces significant supply chain risks and potential for remote code execution.
[INDIRECT_PROMPT_INJECTION]: The skill's primary workflow requires the agent to read and "literally follow" instructions contained within SKILL.md files downloaded from a remote repository. This creates a high-risk surface for indirect prompt injection, where a compromised or malicious remote file could override the agent's behavior, leading to unauthorized actions or data access.
Ingestion points: Remote files downloaded to ~/.cache and read during Step 4 (SKILL_PATH/SKILL.md).
Boundary markers: Absent. The instructions command the agent to follow the external file's instructions literally without additional validation.
Capability inventory: Shell command execution, git operations, browser interaction, and file system writes.
Sanitization: None present for the content of the external workflow files.

opendesign