The Agent Skills Directory

External Code Downloads: The skill includes code snippets that fetch and run scripts from external repositories over the network at runtime.
Evidence: In SKILL.md, a PowerShell inline provisioner downloads and installs Chocolatey via iex ((New-Object System.Net.WebClient).DownloadString('https://community.chocolatey.org/install.ps1')). While this is standard for setting up the Chocolatey package manager, fetching scripts directly into an expression execution environment bypassing local inspection is a potential risk if the vendor infrastructure or network path is ever compromised.
Execution Policy Alteration: The configuration contains instructions to bypass script execution boundaries on the guest operating system.
Evidence: In SKILL.md, the code includes Set-ExecutionPolicy Bypass -Scope Process -Force across multiple PowerShell provisioner samples. This is a normal practice during automated provisioning to allow unsigned setup scripts to run within the temporary installer process, but it requires awareness that script execution guardrails are lowered for that duration.
WinRM Communication Configuration: The provisioners instruct the system to permit unencrypted or unverified network connectivity during the configuration phase.
Evidence: In SKILL.md, the configurations include settings like winrm_insecure = true alongside script commands like winrm set winrm/config/service '@{AllowUnencrypted="true"}'. These are common for initial provisioning contexts where certificates aren't yet fully established, but care should be taken to ensure that these configurations do not persist into final production images or expose interfaces across public network spaces.

windows-builder