The Agent Skills Directory

[REMOTE_CODE_EXECUTION]: The skill documents and implements a bootstrap process for cloud sessions (specifically Claude Code) that involves piping a remote script directly into the Python interpreter (curl -fsSL ... | python3). This pattern, found in references/claude-code/cloud.md and scripts/cloud_bootstrap.py, allows for arbitrary code execution. While the GitHub repository source is parameterized, this mechanism is a significant security risk as it bypasses standard installation safeguards.
[INDIRECT_PROMPT_INJECTION]: The skill's operational logic is heavily dependent on content ingested from an external 'workstation repository' (e.g., setup/instructions.md, setup/permissions.json). An attacker who compromises this repository could inject malicious instructions or override the agent's safety guardrails, which the skill is paradoxically designed to enforce.
[COMMAND_EXECUTION]: The skill frequently executes shell commands via various scripts (verify.py, pre_tool_hook.py) to perform machine audits, install packages, and configure harness environments. This includes the use of subprocess.run to execute git and shell utilities based on paths derived from external configuration files.
[DYNAMIC_EXECUTION]: The scripts/cloud_bootstrap.py script dynamically modifies the settings.json file of the Claude Code harness to add 'allow' rules for arbitrary shell commands specified in the workstation repository. This runtime modification of security policies represents a dynamic execution risk.
[SAFE_PRACTICE_EXEMPTION]: Although the static scanner flagged destructive commands in rules.json, these strings are part of a 'deny' list intended to prevent the agent from executing dangerous operations. Similarly, instructions to store secrets in .env files or environment variables follow standard secret management practices and are not considered findings under the credentials_unsafe category.

set-up-machine