The Agent Skills Directory

[REMOTE_CODE_EXECUTION]: The skill recommends installing its core CLI tool by piping a remote script from 'https://gitlawb.com/install.sh' directly into the shell in both SKILL.md and scripts/setup.sh. This pattern executes remote code without integrity checks and is susceptible to man-in-the-middle attacks or source compromise.
[CREDENTIALS_UNSAFE]: The command 'gl name register' explicitly instructs users to pass an 'ETH_PRIVATE_KEY' as a plaintext command-line argument. This practice exposes sensitive cryptographic credentials to shell history, process monitors, and system logs.
[COMMAND_EXECUTION]: The skill relies on executing the 'gl' and 'git' binaries through the shell to manage identities, repositories, and network synchronization. This provides an execution path for any instructions returned by the decentralized node network.
[EXTERNAL_DOWNLOADS]: The skill downloads executable binaries and packages from 'gitlawb.com' and 'npmjs.com'. While 'npmjs.com' is a standard registry, 'gitlawb.com' is an external domain not recognized as a well-known trusted service.
[DATA_EXPOSURE]: The skill manages sensitive cryptographic identity files located at '~/.gitlawb/identity.pem'. Unauthorized access to these files would allow an attacker to impersonate the user's decentralized identity (DID).
[DATA_EXFILTRATION]: The presence of tools like 'identity_export' and 'identity_sign' provides a mechanism for reading and signing with private keys, which could be abused to exfiltrate identity metadata or authorize unauthorized transactions if the agent's context is compromised.

gitlawb