The Agent Skills Directory

[REMOTE_CODE_EXECUTION]: The skill instructs the user to install the Bun runtime using a piped-to-shell command: curl -fsSL https://bun.sh/install | bash in SKILL.md. While this is a standard installation method for a well-known development tool, it constitutes remote code execution from a third-party domain.
[COMMAND_EXECUTION]: The documentation describes using the agent to execute various system commands in response to external events, including gh run view, kubectl logs, journalctl, and npm run. It also details the use of the --dangerously-skip-permissions flag, which allows the agent to execute these commands without per-operation human approval.
[EXTERNAL_DOWNLOADS]: The skill facilitates the installation of external plugins using the /plugin install command (e.g., telegram@claude-plugins-official), which fetches code from a remote registry.
[PROMPT_INJECTION]: The skill's documentation in references/security-and-permissions.md explicitly discusses prompt injection risks associated with the Channels feature. This is documented for educational and safety purposes and is not an attempt to inject the analyzing agent. The static analysis hint regarding instruction overrides appears to be a false positive triggered by this documentation.
[DATA_EXFILTRATION]: While the skill does not contain hardcoded credentials, it describes the use of bot tokens (Telegram/Discord) as sensitive credentials and instructs users on how to manage them. There is a risk of data exposure if these tokens are mishandled by the user or the agent when operating autonomously.
[INDIRECT_PROMPT_INJECTION]: The skill defines a significant attack surface for indirect prompt injection.
Ingestion points: Untrusted data enters the agent's context through CI/CD failure logs, monitoring alert payloads, and incoming messages from Telegram or Discord (identified in references/custom-channels.md and references/harness-patterns.md).
Boundary markers: No specific delimiters or boundary markers are implemented to isolate untrusted data from the agent's instructions.
Capability inventory: The agent is encouraged to use powerful tools including gh, kubectl, git, and npm to investigate and potentially fix issues found in external data.
Sanitization: No sanitization or validation of the external payloads is described; the skill relies on user-provided natural language prompts to guide the agent's behavior.

claude-channels