The Agent Skills Directory

[REMOTE_CODE_EXECUTION]: The skill instructions include a command to install the mise tool by piping a remote script directly to a shell (curl https://mise.run | sh). This pattern bypasses integrity checks and poses a high risk if the remote source or transmission is compromised.
[COMMAND_EXECUTION]: The skill uses Invoke-Expression in PowerShell to evaluate strings as commands. This dynamic execution method is highly susceptible to command injection if the input strings are manipulated by external files or project-level configurations.
[PERSISTENCE]: The skill explicitly directs the agent to modify the user's PowerShell profile ($PROFILE) to include an activation command. This creates a persistent mechanism that executes code automatically whenever a new shell session is started, potentially running untrusted code if the profile is altered.
[INDIRECT_PROMPT_INJECTION]: The skill processes untrusted project-level configuration files to determine environment settings, creating an attack surface for indirect instructions.
Ingestion points: Multiple files including mise.toml, .tool-versions, and package.json are read from the current project directory.
Boundary markers: No explicit markers or instructions are provided to the agent to treat data from these files as untrusted or to ignore embedded shell commands.
Capability inventory: The skill utilizes sensitive capabilities including mise install, corepack enable, and mise exec, which can be triggered by these configuration files. Specifically, mise.toml supports postinstall hooks that execute arbitrary shell commands.
Sanitization: The instructions lack any validation or sanitization of the version strings or configuration values retrieved from these files before they are interpolated into execution commands.

nodejs-use