The Agent Skills Directory

[REMOTE_CODE_EXECUTION]: The installation instructions use the curl | bash pattern to fetch and execute a shell script (install.sh) directly from a third-party GitHub repository (browser-use/bux). This occurs with root privileges via sudo, creating a high-risk execution vector.
[COMMAND_EXECUTION]: The Telegram bot bridge implementation uses subprocess.run to call the claude CLI with raw input from Telegram. This allows the agent to perform actions and execute commands on the host VPS based on remote instructions received over the internet.
[PROMPT_INJECTION]: The skill is vulnerable to indirect prompt injection.
Ingestion points: Raw text from Telegram messages in telegram_bot.py.
Boundary markers: None; input is passed directly to the agent's prompt.
Capability inventory: Full terminal access via the claude CLI and subprocess modules.
Sanitization: No escaping or validation is performed on the incoming Telegram message before it is processed by the AI agent.
[CREDENTIALS_UNSAFE]: The documentation instructs users to pass sensitive API keys (including ANTHROPIC_API_KEY, BROWSER_USE_API_KEY, and TG_BOT_TOKEN) as environment variables directly in the shell. This can cause secrets to be logged in plain text in the user's .bash_history file.
[COMMAND_EXECUTION]: The skill configuration allows the AI agent to manage systemd services and execute commands as a dedicated bux user, which provides the agent with persistent control over the server's environment and background processes.

bux-claude-agent