The Agent Skills Directory

Dynamic Execution (MEDIUM): The skill relies on the opensrc_execute tool (documented in references/opensrc-api.md), which executes arbitrary JavaScript async arrow functions on a server. While intended for code analysis, this provides a primitive for general code execution.
Indirect Prompt Injection (LOW): The skill is designed to ingest untrusted data which could contain malicious instructions.
Ingestion points: Content is fetched from arbitrary public repositories and registries via opensrc.fetch, opensrc.read, and opensrc.grep (referenced in references/opensrc-api.md).
Boundary markers: Analysis of SKILL.md and references/opensrc-examples.md shows no instructions for the agent to use delimiters or ignore embedded instructions when reading external code.
Capability inventory: The agent can read/write files and execute JavaScript on a server through the toolset.
Sanitization: No sanitization or validation of the fetched source code is performed before it is processed by the agent.
External Downloads (LOW): The skill fetches packages and repositories from GitHub, npm, PyPI, and crates.io. While these are trusted registries per [TRUST-SCOPE-RULE], the content downloaded is attacker-controlled and processed with high-capability tools.
Metadata Poisoning (LOW): SKILL.md includes instructions to 'Never mention tool names' in responses, which is a deceptive practice that obscures the agent's internal operations from the user.

librarian