The Agent Skills Directory

[REMOTE_CODE_EXECUTION] (CRITICAL): The skill's installation instructions use a 'curl | bash' pattern: curl -sSL https://raw.githubusercontent.com/Dicklesworthstone/ultimate_bug_scanner/main/install.sh | bash.
Evidence: The script is hosted in the Dicklesworthstone repository, which is not a trusted source according to security standards.
Risk: Piped remote execution is a high-risk vector as the content of the script can be changed at any time by the repository owner to include malicious commands such as credential theft or persistence mechanisms.
[EXTERNAL_DOWNLOADS] (HIGH): The skill directs the agent/user to download and execute files from an unverified external source.
Evidence: URL: https://raw.githubusercontent.com/Dicklesworthstone/ultimate_bug_scanner/main/install.sh.
[COMMAND_EXECUTION] (MEDIUM): The skill involves the execution of various CLI commands (ubs, rg, ast-grep, jq) that interact with the local file system and source code.
Evidence: Commands like ubs --staged or ubs . involve scanning the entire project directory, which could be exploited if the binary itself is malicious.

ubs