The Agent Skills Directory

[REMOTE_CODE_EXECUTION]: The skill directs the agent to execute "npx clean-room-skill@latest init", which downloads and runs code from the public npm registry at runtime. Executing unversioned packages from a public registry carries a risk of running malicious code if the package is compromised.
[COMMAND_EXECUTION]: The workflow relies on the "clean-room-skill" CLI tool to perform operations like environment setup and artifact validation. This involves executing multiple shell commands with arguments derived from configuration data.
[EXTERNAL_DOWNLOADS]: The skill initiates a download of the "clean-room-skill" package from "registry.npmjs.org". Although npm is a well-known service, the package itself is not from a verified trusted organization.
[DATA_EXFILTRATION]: The skill manages a directory structure in the user's home folder and creates configuration artifacts containing authorization preferences and project metadata. Handling these files involves processing potentially sensitive environment information.
[PROMPT_INJECTION]: The skill is vulnerable to indirect prompt injection because it reads and processes data from external files like "task-manifest.json" and ".clean-room/local-state.json".
Ingestion points: The agent reads state from local JSON files.
Boundary markers: No delimiters are specified to isolate instructions within the ingested data.
Capability inventory: The skill can execute CLI commands and write to the file system.
Sanitization: No validation or sanitization of the file contents is described.

init