The Agent Skills Directory

[REMOTE_CODE_EXECUTION] (HIGH): The installation guide in references/installation.md promotes the use of curl -sfL https://direnv.net/install.sh | bash. This pattern is highly susceptible to Man-in-the-Middle attacks or server-side compromises, leading to arbitrary code execution.
[EXTERNAL_DOWNLOADS] (HIGH): The source_url function, documented in references/stdlib-functions.md, allows the agent to download and source shell scripts from arbitrary external URLs. This provides a direct mechanism for remote code execution at runtime.
[COMMAND_EXECUTION] (HIGH): The skill requires users to add hooks to shell profiles (e.g., eval "$(direnv hook zsh)"). This creates a persistent mechanism where code is executed every time the shell prompt is rendered or the directory changes.
[COMMAND_EXECUTION] (HIGH): The core functionality involves executing the contents of .envrc files. As detailed in the Category 8 (Indirect Prompt Injection) threat model, this combines the ingestion of untrusted data with full shell execution capabilities.
Ingestion points: .envrc and .env files in the local filesystem.
Boundary markers: Relies on the direnv allow manual authorization step to mitigate accidental execution.
Capability inventory: Full subprocess and shell execution via the host's shell.
Sanitization: None; scripts are executed directly as shell code.

direnv