The Agent Skills Directory

[REMOTE_CODE_EXECUTION]: The installation section contains a command that fetches a script from https://varlock.dev/install.sh and pipes it directly into the shell (| sh). This pattern executes remote code without prior verification or integrity checks.
[DYNAMIC_EXECUTION]: The skill documentation for the .env.schema file highlights the ability to use exec() calls to fetch values (e.g., exec('op read ...') or exec('aws ...')). This runtime execution of shell commands from a configuration file represents a significant dynamic execution risk if the schema file is modified by a malicious actor.
[INDIRECT_PROMPT_INJECTION]: The skill includes logic for processing untrusted .env and .env.schema files which may contain embedded instructions or command execution triggers. * Ingestion points: The varlock CLI reads and processes project files like .env and .env.schema to manage environment variables. * Boundary markers: The skill does not define specific boundaries or safety instructions to ignore potential commands embedded within these data files. * Capability inventory: The skill facilitates shell command execution via the exec() function in schemas and through the varlock run command which wraps other processes. * Sanitization: There is no evidence of sanitization or validation of the input strings passed to exec() or the commands wrapped by varlock run.
[COMMAND_EXECUTION]: The skill defines usage patterns like varlock run -- <cmd>, which allows the agent to execute arbitrary shell commands under the guise of environment variable management. While intended to inject secrets, this capability can be misused to execute unauthorized commands if the instruction flow is compromised.

varlock