The Agent Skills Directory

[REMOTE_CODE_EXECUTION]: The README.md file contains a command to install a 'statusline' component using the pattern curl -sL https://raw.githubusercontent.com/tw93/Waza/main/scripts/setup-statusline.sh | bash. This executes a remote script directly in the user's shell environment without prior inspection.
[DATA_EXFILTRATION]: The skills/health/scripts/collect-data.sh script performs extensive harvesting of sensitive local data. It reads ~/.claude/settings.local.json, which frequently contains API tokens and credentials, and extracts user and assistant messages from session logs stored in ~/.claude/projects/. While the script attempts local redaction, it exposes private conversation history and local configurations to the AI context.
[EXTERNAL_DOWNLOADS]: The read skill utilized in skills/read/scripts/fetch.sh routes user-provided URLs through third-party web proxies including defuddle.md and r.jina.ai. This transmits potentially sensitive internal URLs to external services for processing.
[COMMAND_EXECUTION]: The skills/check/scripts/run-tests.sh script automatically detects and executes verification commands found in the current project (e.g., cargo test, npm test, make test, pytest). This allows the agent to execute arbitrary code defined within the build system of any project it is used on.
[COMMAND_EXECUTION]: The setup-statusline.sh script modifies the local environment by creating files in ~/.claude/ and editing the ~/.claude/settings.json file to inject a custom statusLine command.

waza