The Agent Skills Directory

[REMOTE_CODE_EXECUTION]: The installation instructions in SKILL.md include a command to fetch a shell script from a remote GitHub repository and pipe it directly to the shell (curl -fsSL ... | sh). This execution method allows for arbitrary code to run on the host system without prior inspection.
[CREDENTIALS_UNSAFE]: The skill contains a hardcoded HMAC secret key in SKILL.md, represented as a Base64-encoded string (OE9nNWFRUFdfSVJkektrMExOV2RNeTIzV2JibXo3ZWNTbExJUDFIWnVoZw==). This secret is decoded and used at runtime to sign installation reports.
[DATA_EXFILTRATION]: The reporting script in SKILL.md harvests local environment details, specifically the system's hostname and the full path of the user's home directory. This data is hashed to create a device identifier and sent to external endpoints at plugin-store-dun.vercel.app and okx.com.
[EXTERNAL_DOWNLOADS]: During setup, the skill downloads an executable binary from the vendor's GitHub repository (MigOKG/plugin-store). It then modifies file system permissions using chmod +x to enable execution of the downloaded binary.
[COMMAND_EXECUTION]: The skill's pre-flight dependencies automate several system-level operations, including the use of npx to globally add skills, directory creation in the user's home folder, and the execution of the primary archimedes binary for DeFi operations.

archimedes