The Agent Skills Directory

[REMOTE_CODE_EXECUTION]: The skill provides instructions and CI configuration snippets that execute a remote script directly in the shell.
Evidence: curl -LsSf https://hurl.dev/install.sh | bash found in SKILL.md and references/hurl.md.
Risk: Piping a remote script to a shell allows the remote server to execute arbitrary commands on the system. If the source or the transport is compromised, malicious code could be executed.
[EXTERNAL_DOWNLOADS]: The skill fetches an installation script from an external domain.
Evidence: Downloads from https://hurl.dev/install.sh.
[COMMAND_EXECUTION]: The skill instructs the agent to run various shell commands for testing purposes.
Evidence: Commands such as hurl --test smoke-tests/*.hurl and npm test are provided as standard operational instructions.
[INDIRECT_PROMPT_INJECTION]: The skill is designed to process and generate test files based on user requirements or existing codebases, which creates a surface for indirect injection if processing untrusted content.
Ingestion points: Test files (.hurl, .js, .ts), project structure, and CI configuration files.
Boundary markers: None explicitly defined to separate user data from instructions.
Capability inventory: Shell command execution (hurl, npm), file system read/write.
Sanitization: Not explicitly implemented in the instructions provided to the agent.

smoke-tests