liatrio-ai-prompts

The download script uses filename extraction from external JSON data without proper sanitization. While jq provides some protection, malicious filenames in the JSON response could potentially cause issues with file operations.

The bash scripts make HTTP requests to external domains without proper error handling or data validation. While the domain appears legitimate (liatrio.com), the scripts could potentially expose system information through HTTP headers or error messages if the domain is compromised.

The skill does not declare allowed-tools in its manifest, but the scripts perform network operations and file system writes. While this field is optional, declaring tool restrictions would improve security transparency.

The skill manifest is missing optional metadata fields including license, compatibility, and allowed-tools. While these fields are optional per the agent skills specification, their absence reduces transparency about the skill's intended usage constraints and compatibility requirements.

The skill instructions reference example files (script.py, print.py) that are not included in the skill package. While these appear to be documentation examples rather than functional dependencies, missing referenced files could cause confusion during skill usage.