The Agent Skills Directory

[EXTERNAL_DOWNLOADS]: The skill uses brew create and brew fetch to download source archives, binaries, and DMG files from remote URLs provided by the user.
[REMOTE_CODE_EXECUTION]: The skill executes local build systems (such as make, cmake, cargo, and go) and formula-defined test blocks via commands like brew install --build-from-source and brew test. This results in the execution of code contained within the software being packaged.
[COMMAND_EXECUTION]: Extensive use of CLI tools including brew, git, gh, and shasum. It also includes examples using sudo within Homebrew Cask uninstall and postflight blocks for system configuration, which is standard for macOS application management but requires elevated privileges.
[PROMPT_INJECTION]: The skill is susceptible to indirect prompt injection as it ingests untrusted data from external URLs (identified in SKILL.md) without boundary markers or sanitization. If a processed formula or cask contains malicious instructions in its metadata or test blocks, it could be executed during the agent's verification workflow. Mandatory Evidence Chain: (1) Ingestion point: User-supplied URLs for brew create in SKILL.md. (2) Boundary markers: Absent. (3) Capability inventory: Subprocess execution via brew install and brew test in SKILL.md. (4) Sanitization: Absent.

homebrew-dev