The Agent Skills Directory

[COMMAND_EXECUTION]: The script scripts/embed-switch.sh modifies the user's shell configuration files (~/.bashrc and ~/.profile) using sed. Modifying shell startup scripts is a significant system change and a common persistence technique.\n- [COMMAND_EXECUTION]: The script scripts/embed-test.sh interpolates the $TEXT variable directly into a shell command executing curl. This allows for shell command injection if the input provided by the user contains shell metacharacters such as backticks or command substitution syntax.\n- [CREDENTIALS_UNSAFE]: The scripts scripts/embed-status.sh and scripts/embed-test.sh programmatically retrieve a Google API key from the system's pass password manager (pass show api/google-ai-studio). This practice increases the exposure surface of sensitive credentials by making them accessible to any process that can observe the script's execution or environment.\n- [COMMAND_EXECUTION]: The skill documentation describes patching a global Node.js module file located at /home/aa/.npm-global/lib/node_modules/@tobilu/qmd/dist/llm.js. Modifying shared system or library files is an invasive action that can affect the stability and security of other tools on the system.

qmd-extended