The Agent Skills Directory

[REMOTE_CODE_EXECUTION]: The skill instructs the agent to download and execute a JavaScript file from a remote server during the verification step.
Evidence: The instruction in Step 5: curl -fsSL https://flow.viasocket.com/viasocket-check.mjs -o viasocket-check.mjs followed by node viasocket-check.mjs src. This pattern allows for the execution of arbitrary code fetched at runtime.
[INDIRECT_PROMPT_INJECTION]: The skill is designed to fetch external documentation files and follow them as primary instructions, which creates a vulnerability to malicious content in those remote files.
Ingestion points: The skill fetches markdown documents from https://flow.viasocket.com/documentation/<service_id>.md (Step 2).
Boundary markers: The skill instructs the agent to download these files and save them locally to be used alongside the main skill instructions, but lacks specific sanitization or delimiters for the external content.
Capability inventory: The agent is empowered to execute network requests (via curl and APIs), perform actions in third-party apps, and run shell commands.
Sanitization: The skill explicitly states that "Where this file and that one differ, the app's document wins," which allows external data to override the skill's own logic.
[COMMAND_EXECUTION]: The instructions involve executing multiple shell commands, including curl for downloading resources and node for running scripts, which can be misused if the environment is not properly restricted.
[EXTERNAL_DOWNLOADS]: The skill relies on fetching multiple external resources, including documentation, application schemas, and execution templates from flow.viasocket.com and flow.sokt.io.

viasocket-integrations