The Agent Skills Directory

[EXTERNAL_DOWNLOADS]: The skill provides commands to download the openhue binary directly from a GitHub releases page (github.com/openhue/openhue-cli).
[REMOTE_CODE_EXECUTION]: The Linux installation instructions involve downloading an external binary and marking it as executable, which leads to the execution of code from a third-party source.
[PRIVILEGE_ESCALATION]: The skill instructs the user to use chmod +x on the downloaded binary to grant execution permissions on the local system.
[COMMAND_EXECUTION]: The skill's core functionality relies on executing the openhue CLI tool with various arguments to control IoT hardware.
[INDIRECT_PROMPT_INJECTION]: The skill ingests data from external IoT devices (Philips Hue Bridge), such as names of lights, rooms, and scenes. This represents an attack surface where maliciously named resources could attempt to influence agent behavior during processing.
Ingestion points: Data retrieved via openhue get light, openhue get room, and openhue get scene in SKILL.md.
Boundary markers: None identified in the prompt interpolation.
Capability inventory: Subprocess execution of openhue commands.
Sanitization: No explicit sanitization of resource names before they are processed by the agent.

openhue