The Agent Skills Directory

[REMOTE_CODE_EXECUTION] (MEDIUM): The script skills-cli.ts uses npx to search for and install packages (e.g., npx skills add). Since npx downloads and executes code from the npm registry at runtime, it introduces a risk of remote code execution if the package source is compromised or if typosquatting occurs.
[COMMAND_EXECUTION] (MEDIUM): Several scripts (search.ts, skills-cli.ts) use Bun.spawn to execute external binaries like gh and npx. While using array-based arguments helps prevent shell injection, these commands execute system-level operations with parameters derived from external skill data.
[PROMPT_INJECTION] (LOW): The skill is susceptible to Indirect Prompt Injection (Category 8) because it ingests and processes untrusted data from other skills.
Ingestion points: scripts/interactive.ts reads generated analysis files (e.g., /tmp/skill-assessment-prompt.md) containing content from third-party skills.
Boundary markers: None. Untrusted content from the audited skills is placed directly into the configuration for the interview tool.
Capability inventory: The skill can install or update other skills via Bun.spawn, which an attacker could exploit to trigger the installation of malicious tools.
Sanitization: There is no evidence of escaping or sanitizing the content before it is presented to the agent in a decision-making context.
[EXTERNAL_DOWNLOADS] (LOW): scripts/search.ts initiates outbound network requests to skills.sh to fetch trending metadata, which is a non-whitelisted external domain.

skill-management