The Agent Skills Directory

COMMAND_EXECUTION (HIGH): The skill creates and executes shell scripts (scripts/conductor-setup.sh) and generates a conductor.json file containing arbitrary shell commands for the 'run' and 'setup' keys. These commands are executed via zsh and are derived from the agent's inspection of untrusted repository files.
DATA_EXFILTRATION / EXPOSURE (MEDIUM): The skill is specifically designed to discover and symlink sensitive .env and .env.local files. While intended for local development, this mechanism could be abused to expose sensitive host credentials by symlinking them into workspace directories that might have different access controls or visibility.
INDIRECT PROMPT INJECTION (HIGH): The skill processes untrusted repository content to make decisions about what commands to write into executable configuration files.
Ingestion points: The agent 'inspects' the repository structure, package manager files (e.g., package.json, requirements.txt), and framework configurations to determine setup and run commands.
Boundary markers: None. There are no delimiters or instructions to ignore embedded commands within the files being inspected.
Capability inventory: The skill uses chmod +x, creates shell scripts, creates JSON configuration files that execute shell commands, and performs filesystem symlinking (ln -sf).
Sanitization: No sanitization or validation is performed on the 'detected' commands before they are written to conductor.json or scripts/conductor-setup.sh.
REMOTE_CODE_EXECUTION (MEDIUM): The skill instructs the agent to perform package installations (npm install, pip install, etc.) based on the detected project type. While standard for setup tools, these installations are unverifiable and occur automatically as part of the setup workflow.

conductor-setup