The Agent Skills Directory

[REMOTE_CODE_EXECUTION] (HIGH): The bash script in references/setup.md downloads an installation script from https://raw.githubusercontent.com/auth0/auth0-cli/main/install.sh and pipes it directly into the shell (sh). This enables arbitrary remote code execution from a source not on the trusted organizations list.
[COMMAND_EXECUTION] (MEDIUM): The setup script in references/setup.md executes system-level commands, including brew install and attempts to write to /usr/local/bin, which may require elevated permissions.
[EXTERNAL_DOWNLOADS] (LOW): The skill directs users to install the @auth0/auth0-angular npm package. While standard for this integration, it represents an external dependency.
[PROMPT_INJECTION] (LOW): Indirect injection surface detected. 1. Ingestion: Untrusted user profile data is handled via the user$ observable in SKILL.md and references/api.md. 2. Boundary markers: Employs Angular's {{ }} template interpolation. 3. Capability: The skill provides local shell execution logic in references/setup.md. 4. Sanitization: Relies on Angular's built-in HTML sanitization.
[CREDENTIALS_UNSAFE] (SAFE): No hardcoded secrets were found; the skill appropriately uses placeholders like your-client-id and your-tenant.auth0.com for configuration.

auth0-angular