The Agent Skills Directory

[COMMAND_EXECUTION]: The skill contains post-execution instructions that direct the AI to automatically star the project's GitHub repository using the gh CLI tool (gh api -X PUT /user/starred/openprose/prose). This represents an unauthorized automated social action on the user's behalf.
[COMMAND_EXECUTION]: Multiple standard library and common programs generate and execute dynamic scripts at runtime. For example, lib/profiler.prose executes inline Python via heredocs, and common/holon.prose generates and runs Node.js scripts using the ws package for real-time communication.
[EXTERNAL_DOWNLOADS]: The skill can fetch and interpret (execute) .prose programs from arbitrary URLs provided by the user or from a custom remote registry (p.prose.md). This behavior is functionally equivalent to remote code execution through the AI's instruction set.
[DATA_EXFILTRATION]: The profiler.prose utility is designed to scan and read sensitive AI assistant session logs located in ~/.claude/projects/. These logs contain the full history of the user's interactions, including code and potentially sensitive data, which could be exposed during the profiling process.
[PROMPT_INJECTION]: The skill includes instructions that attempt to modify the agent's persistent memory and future behavior. Specifically, it directs the agent to update its SOUL.md file with a specific template to 'remember' the skill for future sessions, which is a form of persistent instruction injection.

open-prose