The Agent Skills Directory

[REMOTE_CODE_EXECUTION]: The script scripts/install-system.js uses a dangerous pattern to download and immediately execute shell scripts from external URLs (specifically from NodeSource and NVM) using curl | bash.
[REMOTE_CODE_EXECUTION]: The scripts/smart-interface.js file dynamically generates Node.js script files in the tasks/ directory based on descriptions provided in user prompts. These generated scripts are then executed by the system's task scheduler, which can be exploited to run unauthorized code.
[COMMAND_EXECUTION]: Numerous scripts, including install.js, install-system.js, and smart-interface.js, utilize child_process.execSync to run shell commands. This includes performing actions with elevated privileges via sudo and managing system processes with pm2.
[EXTERNAL_DOWNLOADS]: The skill is designed to download and install the opencron-system package globally or locally from the NPM registry during its setup process.
[COMMAND_EXECUTION]: scripts/config.js contains a suspicious call to an external Python script located at a relative path outside the skill's own directory (trast-mechanism/scripts/safe_copy.py), which may not exist or be verifiable in all environments.

opencron