The Agent Skills Directory

[REMOTE_CODE_EXECUTION]: The installation guide in data/install.md documents a method to install the required x-cmd tool via a remote shell script using curl -fsSL https://get.x-cmd.com | sh. While this is a common pattern for CLI tools from this vendor, the documentation correctly identifies it as a high-risk method and recommends safer alternatives.
[EXTERNAL_DOWNLOADS]: The skill facilitates downloading binary packages and core files from the vendor's official GitHub repository (github.com/x-cmd/release) and conda.prefix.dev for tool installation.
[INDIRECT_PROMPT_INJECTION]: The x rfc :: function processes RFC documents from external sources to provide AI-generated summaries, creating a surface for indirect prompt injection if the retrieved documents contain malicious instructions.
Ingestion points: External RFC documents retrieved via the x rfc command.
Boundary markers: None identified in the skill instructions to separate document content from agent instructions.
Capability inventory: The skill provides document listing, viewing, and searching capabilities. No dangerous capabilities like arbitrary file writing or system command execution based on document content were detected.
Sanitization: There is no evidence of sanitization or filtering of the retrieved RFC content before it is processed for summarization.

x-rfc