The Agent Skills Directory

EXTERNAL_DOWNLOADS (MEDIUM): The skill instructs the agent to install the @alavida/cli package from npm. This package is not managed by a verified trusted organization (e.g., Anthropic, Google, Microsoft), introducing a third-party dependency risk.
COMMAND_EXECUTION (MEDIUM): The skill requests wildcard permissions for the alavida binary (Bash(alavida *)). This allows the execution of any subcommand, including auth, run, and registry, which could lead to unauthorized credential handling or unexpected tool behavior if the binary is compromised.
PRIVILEGE_ESCALATION (MEDIUM): The use of npm install -g suggests a requirement for global system access, which typically requires administrative or root privileges (sudo).
INDIRECT_PROMPT_INJECTION (LOW): The skill is designed to process external data points like company names and social media profiles which could contain malicious instructions.
Ingestion points: The --input flag accepts JSON objects containing company and person metadata, and can also read from a local companies.json file.
Boundary markers: None provided in the command structure; the CLI treats input values as literal data for analysis.
Capability inventory: The skill utilizes Bash(alavida *) to send this data to a remote API.
Sanitization: No sanitization of the input fields (e.g., company_name, full_name) is documented before the data is passed to the CLI tool.

buying-signals