The Agent Skills Directory

Remote Code Execution (HIGH): The skill instructs the user to install the 'mise' tool using curl https://mise.run | sh. Piping a remote script directly into a shell without verification is a critical security risk, as it allows for the execution of unverified and potentially malicious code from an external source.
Persistence Mechanism (HIGH): The skill automatically modifies the user's shell configuration (~/.zshrc) to execute a 'mise activate' command on every new session. This ensures that the tool and its associated automated tasks are persistently loaded into the user's environment.
Command Execution (MEDIUM): The skill generates and sets executable permissions for git hooks (commit-msg, pre-commit, pre-push) that execute mise run commands. This allows for automated, hidden command execution during routine version control operations.
External Downloads (LOW): The skill frequently uses bunx and uv run to download and execute Node.js and Python packages at runtime. While common in development, these represent dynamic execution of remote code that could be subject to supply chain attacks.

developer-workflow