The Agent Skills Directory

[REMOTE_CODE_EXECUTION] (CRITICAL): The installation instructions provide a command curl -fsSL "https://raw.githubusercontent.com/Dicklesworthstone/ultimate_bug_scanner/master/install.sh?$(date +%s)" | bash -s -- --easy-mode. This is a piped remote execution pattern from an untrusted source, which is a high-risk vector for arbitrary code execution.
[EXTERNAL_DOWNLOADS] (HIGH): The manual installation process downloads a binary from an unverified GitHub account (Dicklesworthstone) to /usr/local/bin and grants execution permissions via chmod +x. This bypasses standard security vetting and package management safety.
[COMMAND_EXECUTION] (MEDIUM): The ubs doctor --fix command attempts to modify the user's environment by programmatically installing third-party tools such as ast-grep, ripgrep, and jq, which constitutes significant system-level changes.
[INDIRECT_PROMPT_INJECTION] (LOW): The skill processes untrusted source code and returns results that influence agent behavior. An attacker could embed malicious comments in the code to mislead the quality gate. Evidence Chain: 1. Ingestion points: ubs <changed-files> in SKILL.md. 2. Boundary markers: Absent for ingested code. 3. Capability inventory: System-level file access and subprocess execution via ubs commands. 4. Sanitization: Not specified for external code inputs.

ubs