The Agent Skills Directory

COMMAND_EXECUTION (HIGH): The skill repeatedly instructs the agent to use the runCommand tool with sandbox: false for tasks like pnpm add and application management. This parameter explicitly disables security restrictions, granting the agent arbitrary shell access to the host machine with network capabilities.
CREDENTIALS_UNSAFE (HIGH): The skill documents the specific path and structure of ~/.moldable/shared/.env, explicitly identifying it as a store for sensitive secrets including ANTHROPIC_API_KEY and OPENAI_API_KEY. It provides procedures for reading and writing these credentials.
PROMPT_INJECTION (HIGH): The moldable:set-chat-instructions API enables a Category 8 (Indirect Prompt Injection) vulnerability surface where external applications can programmatically modify the agent's system prompt context. Evidence: 1) Ingestion points: postMessage events in references/desktop-apis.md; 2) Boundary markers: Absent; 3) Capability inventory: Non-sandboxed runCommand, file system manipulation via writeFile and deleteApp; 4) Sanitization: None described.
REMOTE_CODE_EXECUTION (HIGH): The workflows for scaffoldApp and dependency management allow the agent to download and execute arbitrary third-party code from the NPM registry. When executed with sandbox: false, this facilitates unverified code execution on the user's host.
EXTERNAL_DOWNLOADS (MEDIUM): The addSkillRepo and syncSkills tools allow the agent to fetch executable content from arbitrary GitHub repositories. While the skill mentions trusted sources such as anthropic/skills (downgraded to LOW per [TRUST-SCOPE-RULE]), the mechanism itself allows for any untrusted source to be integrated.

moldable