The Agent Skills Directory

[REMOTE_CODE_EXECUTION]: The skill automates the installation of external code by cloning repositories and executing npm install --production in lib/installer.js. This process is inherently unsafe as it allows for the execution of arbitrary lifecycle scripts (e.g., preinstall or postinstall) defined in the package.json of any discovered or user-provided repository.\n- [COMMAND_EXECUTION]: The lib/installer.js module uses child_process.exec to run several system-level commands, including git clone, git pull, and npm install. These commands are executed on paths and URLs derived from untrusted external data.\n- [EXTERNAL_DOWNLOADS]: The lib/scout.js and lib/evaluator.js modules make network requests to the GitHub API (api.github.com) to search for repositories and fetch their files. While the service is well-known, the content retrieved originates from arbitrary third-party accounts.\n- [PROMPT_INJECTION]: The skill exhibits an indirect prompt injection surface (Category 8). It ingests metadata and file content (repository descriptions, SKILL.md files) from GitHub to evaluate and score skills.\n
Ingestion points: lib/scout.js (search results) and lib/evaluator.js (fetching repository files).\n
Boundary markers: There are no explicit delimiters or instructions to ignore embedded instructions in the ingested content.\n
Capability inventory: The skill possesses extensive system capabilities including shell command execution (exec), file system modification (symlink, rm), and network operations.\n
Sanitization: The skill lacks robust sanitization of external text before it is processed by the evaluator, potentially allowing a malicious repository to manipulate the scoring or installation logic.

skill-scout