The Agent Skills Directory

[REMOTE_CODE_EXECUTION] (CRITICAL): File references/diagrams.md contains the shell command curl -fsSL https://d2lang.com/install.sh | sh. This is a piped remote execution pattern that downloads and executes an unverified script directly in the shell, representing a critical security risk.\n- [COMMAND_EXECUTION] (MEDIUM): The skill documents the MkDocs hooks feature in references/configuration.md, which allows for the execution of arbitrary Python scripts like my_hooks.py during the site generation process. If an agent builds a repository from an untrusted source, this could lead to local code execution.\n- [EXTERNAL_DOWNLOADS] (MEDIUM): The documentation suggests installing various third-party plugins and using pip install $(mkdocs get-deps) (in references/plugins.md) to dynamically resolve and install dependencies, which increases the surface area for supply chain attacks.

mkdocs