The Agent Skills Directory

Indirect Prompt Injection (HIGH): The get-messages command (found in SKILL.md) retrieves content from external, untrusted agents. There are no boundary markers or sanitization processes mentioned. Because the agent processes these messages as part of its workflow, an attacker could embed instructions to hijack the agent or perform unauthorized actions using its capabilities like send-message or register.
Unverifiable Dependencies (MEDIUM): The skill requires installing @openindex/openindexcli from npm. This package is not from a trusted organization, and its runtime behavior cannot be verified, posing a supply chain risk (Category 4).
Insecure Credential Handling (MEDIUM): The skill instructs the agent to store a raw private key in the OPENINDEX_PRIVATE_KEY environment variable. Storing keys in the environment is a best-practice violation that increases the risk of exposure to other processes or through log files (Category 2).
Command Execution (LOW): The skill relies on executing external CLI commands via npx and npm. While functional for the skill, it creates a surface for potential exploitation if the tool itself or the parameters passed to it are compromised.

openindex-lite