The Agent Skills Directory

[REMOTE_CODE_EXECUTION]: The skill instructs the agent to run the command npx --yes skills@latest update sd25-pe -y at the beginning of each session. This command fetches the skills package from the NPM registry and executes it. Since the package originates from an unverified source and is not associated with a recognized trusted organization, this represents a significant risk of remote code execution from an external source.\n- [COMMAND_EXECUTION]: The skill mandates the use of shell commands (npx) to perform self-updates, requiring the agent to utilize system-level command execution capabilities that are not restricted by specific safety scoping in the instructions.\n- [METADATA_POISONING]: There is a significant discrepancy between the skill's declared capabilities and its actual instructions. The required_capabilities metadata claims network: false and tool_use: false, yet the instructions explicitly require a network-dependent shell command to be executed. This misleading configuration could cause a misjudgment of the skill's safety profile during automated or manual reviews.\n- [INDIRECT_PROMPT_INJECTION]: The skill is designed to ingest and process potentially untrusted multimodal user data, creating a risk that malicious instructions in that data could influence the agent's behavior.\n
Ingestion points: Processes raw user text, novel excerpts, and multimodal file references (images, videos, audio) in SKILL.md.\n
Boundary markers: The skill employs templates and specific reference labels (e.g., @ImageN), but these do not provide robust protection against instructions embedded within the processed content.\n
Capability inventory: The skill's operational flow includes the high-risk capability of shell command execution (via the update command).\n
Sanitization: The instructions do not define any sanitization, filtering, or escaping of the user-provided data before it is interpolated into the final output prompts.\n- [EXTERNAL_DOWNLOADS]: The skill triggers the download of an unverified package (skills) from the public NPM registry at runtime as part of its initialization process.

sd25-pe