The Agent Skills Directory

Remote Code Execution (HIGH): The SKILL.md file contains a recommendation to install the uv tool using curl -LsSf https://astral.sh/uv/install.sh | sh. Executing remote scripts directly in the shell is a high-risk pattern that can be exploited if the source or communication channel is compromised. This finding is not downgraded as the source 'astral.sh' is not in the trusted organization list.
External Downloads (MEDIUM): The skill depends on several external libraries (pinecone, typer, rich) and the uv tool. The use of unverified installation methods for these dependencies increases the supply chain risk.
Indirect Prompt Injection (LOW): The skill ingests and processes user-provided documentation to provide answers, which is a known vector for indirect prompt injection where malicious instructions inside a document could subvert the agent's behavior.
Ingestion points: scripts/upload.py reads local files for indexing; scripts/chat.py and scripts/context.py retrieve this untrusted content to generate responses.
Boundary markers: Absent; the scripts do not appear to wrap retrieved context in protective delimiters or provide 'ignore instructions' directives to the LLM.
Capability inventory: All scripts (scripts/chat.py, scripts/context.py, scripts/create.py, scripts/list.py, scripts/upload.py) perform network operations via the Pinecone SDK. No subprocess, exec, or eval calls were detected.
Sanitization: Absent; the skill does not sanitize or validate document content before it is uploaded or used in queries.

assistant