The Agent Skills Directory

EXTERNAL_DOWNLOADS (HIGH): The script scripts/check_pixi.sh suggests an installation command curl -fsSL https://pixi.sh/install.sh | bash. This pattern involves executing a remote script from a non-trusted domain directly in the shell, which is a significant security risk for agents following these instructions.
COMMAND_EXECUTION (HIGH): The file scripts/pixi_info.py implements shell command execution via subprocess.run(shell=True). This is a high-risk practice that can lead to shell injection if variables like environment names are manipulated by malicious project metadata.
REMOTE_CODE_EXECUTION (HIGH): The combined presence of untrusted installation sources and a shell-execution surface facilitates potential remote code execution.
Indirect Prompt Injection (HIGH): (Category 8) The skill ingests untrusted project data through pixi info and pixi list commands and processes it using shell-based tools. A malicious pixi.toml file in a project directory could contain crafted metadata to exploit the shell-execution capability.
Ingestion points: JSON output from pixi info and pixi list in scripts/pixi_info.py.
Boundary markers: Absent.
Capability inventory: Shell command execution via subprocess.run(shell=True) in scripts/pixi_info.py and various task execution capabilities mentioned in documentation.
Sanitization: Absent.

pixi