The Agent Skills Directory

[EXTERNAL_DOWNLOADS]: The skill instructs the agent to download and add sibling skills from the vendor's repository on GitHub to automate tasks such as SDK migration, event instrumentation, and auditing.
[REMOTE_CODE_EXECUTION]: Logic is fetched and executed from remote sources using npx skills add. Setup instructions for third-party tunneling tools also involve piping remote repository configurations and GPG keys into the system package manager.
[COMMAND_EXECUTION]: The agent is prompted to execute local shell commands for port detection (lsof), environment variable verification in .env files, and starting local development processes.
[PRIVILEGE_ESCALATION]: The playbooks include installation commands for well-known external networking tools that require sudo permissions to modify system package repositories.
[INDIRECT_PROMPT_INJECTION]: The initialization playbook ingests data from a user-supplied website URL to extract brand colors, tone, taglines, and API endpoints for automated project scaffolding. This untrusted external data is interpolated into generated code and styles.
Ingestion points: User-provided website URL processed in scripts/initialize.md.
Boundary markers: None identified for the extracted website content.
Capability inventory: The skill can write files, generate code, and install packages based on the external input.
Sanitization: No explicit validation or sanitization steps are documented for the extracted brand metadata before code generation.

waniwani-sdk