The Agent Skills Directory

[EXTERNAL_DOWNLOADS] (LOW): The skill uses the npx skills add command to download and install packages from the inference.sh registry. While this involves downloading external code from a source not explicitly on the trusted list, it is the primary function of the skill.
[COMMAND_EXECUTION] (LOW): The allowed-tools configuration grants permission to execute npx skills * commands. This provides the agent with the ability to modify its environment by adding or removing software, which is inherently risky but consistent with the skill's utility as a manager.
[REMOTE_CODE_EXECUTION] (LOW): The use of npx involves fetching and executing code from a remote registry at runtime. This is categorized as low severity here because the operations are restricted to the skills package namespace.

related-skill