The Agent Skills Directory

[REMOTE_CODE_EXECUTION] (CRITICAL): The skill documentation includes a command that downloads a script and executes it immediately via the shell.
Evidence: curl -sSL https://numscript.io/install | sh found in the 'Install (CLI)' section.
Risk: This is a highly dangerous pattern as it allows a remote server to execute arbitrary code on the user's system without any prior inspection or verification.
[EXTERNAL_DOWNLOADS] (HIGH): The skill promotes the installation of packages from unverified and untrusted sources.
Evidence: npm install -g numscript and go get github.com/direktly/numscript.
Risk: The 'numscript' organization and the 'numscript.io' domain are not part of the approved Trusted External Sources. Installing global packages from unverified sources presents a significant supply-chain risk.
[COMMAND_EXECUTION] (MEDIUM): The skill defines commands for executing local files using a custom interpreter.
Evidence: numscript run my-script.num and numscript check my-file.num.
Risk: If the agent is used to process files provided by untrusted third parties, the interpreter may be vulnerable to indirect injection or could be used to perform unauthorized operations on the local file system.

numscript-guidelines