The Agent Skills Directory

[EXTERNAL_DOWNLOADS]: The skill relies on npx @web42/stask for core functionality. This command downloads and executes code from the public npm registry at runtime. Since the source is not a recognized trusted vendor and no version is pinned, a malicious update to the package could compromise the agent's environment.
[REMOTE_CODE_EXECUTION]: Executing unverified packages via npx constitutes remote code execution. The agent dynamically fetches and runs code defined in the external @web42/stask package.
[COMMAND_EXECUTION]: The skill instructs the agent to run shell commands including npx, git, and cd. Arguments for these commands, such as task IDs and file paths, are sourced from external heartbeat data, which could be exploited for command injection if the data source is compromised.
[DATA_EXFILTRATION]: The skill performs git push to remote branches and sends status updates via chat.postMessage. These network egress capabilities could be abused to exfiltrate sensitive data if the agent is manipulated via its task inputs.
[PROMPT_INJECTION]: The skill is vulnerable to indirect prompt injection. Ingestion points: Task specifications are read via npx @web42/stask show and environmental context is provided by a heartbeat service. Boundary markers: There are no delimiters or instructions to treat ingested specifications as untrusted data. Capability inventory: The agent has the authority to modify files, execute CLI tools, and push changes to remote git repositories. Sanitization: The instructions do not require the agent to validate or sanitize external specification content or provided file paths before taking action.

stask-worker