The Agent Skills Directory

[REMOTE_CODE_EXECUTION]: The skill instructions recommend installing the core autocli binary by piping a remote script from GitHub directly into the shell.
Evidence: The command curl -fsSL https://raw.githubusercontent.com/nashsu/AutoCLI/main/scripts/install.sh | sh executes unverified code with user privileges.
[DATA_EXFILTRATION]: The skill is designed to access and retrieve sensitive personal information by leveraging the user's logged-in web sessions.
Evidence: Commands such as twitter bookmarks, weread highlights, and bilibili history allow the agent to read private user data.
[COMMAND_EXECUTION]: The skill grants the agent the ability to execute the autocli binary and provides passthrough access to powerful system utilities.
Evidence: The agent can run gh (GitHub CLI), docker, and kubectl commands through the tool.
[PROMPT_INJECTION]: The skill is highly vulnerable to indirect prompt injection due to its broad ingestion of untrusted web content.
Ingestion points: Data enters the context from social media, forums, and transcripts (SKILL.md).
Boundary markers: No markers or warnings to ignore embedded instructions are present.
Capability inventory: The agent has subprocess execution and file writing capabilities.
Sanitization: No sanitization or validation of the fetched web content is documented.
[COMMAND_EXECUTION]: The agent is instructed to dynamically generate and store YAML configuration files that define logic for scraping new websites.
Evidence: The agent is told to write new adapters to the ~/.autocli/adapters/ directory.

autocli