The Agent Skills Directory

REMOTE_CODE_EXECUTION (HIGH): The documentation provides a command to download and execute a shell script from a third-party GitHub repository ('mkasberg/ghostty-ubuntu') using the 'curl | bash' pattern. This represents a critical supply-chain risk as it allows for arbitrary code execution from a source outside the official Ghostty organization.
Evidence: 'docs/005-docs-install-binary.md' contains the command: '/bin/bash -c "$(curl -fsSL https://raw.githubusercontent.com/mkasberg/ghostty-ubuntu/HEAD/install.sh)"'.
EXTERNAL_DOWNLOADS (HIGH): The skill encourages users to install software from several unverified community repositories and personal accounts (e.g., Fedora COPR, Terra, and personal GitHub accounts) that are not part of the project's official or trusted distribution channels.
Evidence: 'docs/005-docs-install-binary.md' references 'scottames/ghostty' on COPR and 'repos.fyralabs.com/terra'.
COMMAND_EXECUTION (MEDIUM): The installation instructions include commands that bypass package manager security features, such as GPG signature checks, which are designed to prevent the installation of tampered or malicious binaries.
Evidence: 'docs/005-docs-install-binary.md' includes 'dnf install --nogpgcheck', which bypasses verification for the Terra repository.
INDIRECT_PROMPT_INJECTION (LOW): The skill identifies an attack surface where themes can modify any configuration option, potentially leading to malicious behavior if an agent or user applies an untrusted theme file.
Evidence: 'docs/009-docs-features-theme.md' notes 'Themes can modify any configuration option... be careful when using themes from untrusted sources.'
Ingestion points: 'docs/009-docs-features-theme.md'.
Boundary markers: Warnings provided in documentation.
Capability inventory: Configuration overrides for fonts, colors, and keybindings.
Sanitization: Absent; the skill relies on user caution.

ghostty-docs