The Agent Skills Directory

[COMMAND_EXECUTION]: The skill's primary function is to execute shell commands via the opencli utility. It can proxy commands to other system tools such as docker, gh (GitHub CLI), vercel, and obsidian as documented in references/command_reference.md.
[REMOTE_CODE_EXECUTION]: The skill facilitates the execution of remote code through several mechanisms:
It encourages the use of opencli plugin install github:user/repo, which allows downloading and executing arbitrary code from any GitHub repository.
The opencli synthesize <site> command automatically generates and executes adapter code for new websites.
The skill instructs users to download and manually install a browser extension from a non-verified GitHub release (https://github.com/jackwener/opencli/releases).
[EXTERNAL_DOWNLOADS]: The skill directs the user to install external software from untrusted sources, including a global NPM package (@jackwener/opencli) and a zip file containing a browser extension. These components are granted broad access to the user's browser sessions and system path.
[INDIRECT_PROMPT_INJECTION]: The skill possesses a wide attack surface for indirect prompt injection by design:
Ingestion points: It reads untrusted data from over 70 social media and news platforms (e.g., twitter search, reddit hot, hackernews top) as seen in SKILL.md.
Boundary markers: None are specified in the instructions to help the agent distinguish between data and instructions.
Capability inventory: The agent can post to social media, download files, and execute system commands via proxied CLIs (docker, gh, etc.).
Sanitization: There is no mention of sanitizing or escaping the content retrieved from external sites before it is processed by the agent.

opencli-agent