The Agent Skills Directory

[REMOTE_CODE_EXECUTION] (CRITICAL): The file references/installation.md contains instructions for the agent to execute untrusted remote scripts via curl -fsSL https://opencode.ai/install | bash and curl -fsSL https://offworld.sh/install | bash. Piped remote execution from non-whitelisted domains is a primary vector for arbitrary code execution and system compromise.
[EXTERNAL_DOWNLOADS] (HIGH): The skill utilizes the ow pull <owner/repo> command to clone external, third-party codebases into the local environment. This bypasses typical safety boundaries by bringing large amounts of untrusted code into the agent's context.
[COMMAND_EXECUTION] (HIGH): The skill requests and uses broad Bash(ow:*) permissions. This allows the execution of a complex CLI tool (ow) which performs high-privilege operations such as initializing agent configurations, setting model providers (ow init --model), and scanning project dependencies.
[INDIRECT_PROMPT_INJECTION] (HIGH):
Ingestion points: ow pull and ow map search ingest data from external GitHub repositories and remote maps.
Boundary markers: None present. There are no instructions to the agent to treat cloned code or generated references as untrusted or to ignore embedded instructions.
Capability inventory: The agent has Bash and Read capabilities, allowing it to execute commands or read files based on malicious instructions found in cloned repos.
Sanitization: No evidence of sanitization for the content processed from external repositories.

offworld