The Agent Skills Directory

[EXTERNAL_DOWNLOADS] (LOW): The documentation recommends installing the @vicinae/api package and related TypeScript types. As Vicinae is not in the trusted organizations list, these are classified as untrusted external downloads.
[COMMAND_EXECUTION] (LOW): Shell commands for tmux are documented to assist with development environment setup. These are transparently used as intended for local development.
[REMOTE_CODE_EXECUTION] (LOW): The documentation refers to using bunx vici, a package runner that executes code directly from the npm registry. This is a common developer pattern but represents a remote code execution vector.
[PROMPT_INJECTION] (LOW): The API reference describes components (e.g., Detail view in references/api-reference.md) that render markdown from potentially untrusted data. This creates an indirect prompt injection surface. Evidence: (1) Ingestion: markdown prop in Detail components; (2) Boundary markers: Absent; (3) Capabilities: open(), Clipboard, and Action.OpenInBrowser in references/api-reference.md; (4) Sanitization: Not specified.

vicinae