The Agent Skills Directory

[REMOTE_CODE_EXECUTION]: The documentation in references/setup.md provides a command that downloads and executes a Python script from an untrusted GitHub repository (yusufkaraaslan/Skill_Seekers) using the curl -fsSL | python3 pattern, which is a high-risk operation.
[EXTERNAL_DOWNLOADS]: The skill requires downloading and installing software from an unverified third-party GitHub account (yusufkaraaslan) that is not part of the trusted vendors list.
[COMMAND_EXECUTION]: The workflow involves running shell scripts like apply-patch.sh and migrate-skill.sh that modify the filesystem in core production directories (~/lev/core/) based on external inputs like design documents.
[PROMPT_INJECTION]: The skill has a high surface for indirect prompt injection as it processes data from arbitrary websites and GitHub repositories using the skill-seekers tool; this ingested data can influence subsequent agent actions such as code generation or patching.
Ingestion points: skill-seekers scrape (external URLs) and skill-seekers github (external repositories) as documented in references/advanced-workflows.md.
Boundary markers: None identified in the scraping or patching logic.
Capability inventory: Filesystem writes via apply-patch.sh, code execution via bun test and bun run typecheck, and repository modification via git commit.
Sanitization: No evidence of escaping or validation of external content before use in patches or commands.
[DATA_EXFILTRATION]: The documentation in references/config-resolution.md exposes sensitive file locations, specifically ~/.local/share/lev/auth/ which is documented to contain cached credentials, creating a risk of targeted data exposure.

lev-builder