The Agent Skills Directory

[EXTERNAL_DOWNLOADS] (MEDIUM): The skill utilizes npx tsx to execute its logic. This triggers a dynamic download of the tsx package from the npm registry if not already cached. Unversioned npx calls are susceptible to package squatting or breaking changes in the fetched dependency.
[REMOTE_CODE_EXECUTION] (MEDIUM): By using npx to run a local script, the skill introduces a runtime dependency on external package repositories. While the script itself is local, the execution environment is constructed dynamically, which is a common vector for supply chain attacks.
[COMMAND_EXECUTION] (MEDIUM): The script executes destructive API calls (DELETE) and state-changing POST requests. These operations use parameters like <model-name> and <pattern> which are provided by the agent. If the agent processes untrusted data to determine these parameters, it could be coerced into deleting or misconfiguring Langfuse model definitions.
[DATA_EXFILTRATION] (LOW): The script reads LANGFUSE_SECRET_KEY and sends it to the configured LANGFUSE_HOST. While necessary for the skill's function, the host is configurable via environment variables, presenting a minor risk if the environment is misconfigured or controlled by an adversary.
[PROMPT_INJECTION] (MEDIUM): This finding relates to Category 8 (Indirect Prompt Injection).
Ingestion points: CLI arguments <model-name> and --pattern in SKILL.md.
Boundary markers: Absent. Arguments are interpolated directly into the Bash command.
Capability inventory: Network fetch (GET, POST, DELETE) used to modify external observability state.
Sanitization: Limited. Prices are parsed as floats, but the model name and regex pattern are used directly in API payloads, allowing for broad model matching or deletion if an attacker-controlled string is processed by the agent.

langfuse-model-upsert