The Agent Skills Directory

[EXTERNAL_DOWNLOADS]: The skill provides instructions to download the Turso CLI and database engine using official channels.
Evidence: curl -sSfL https://get.tur.so/install.sh | bash in SKILL.md and references/01-getting-started.md.
Evidence: cargo install tursodb for the Rust-based database engine.
Evaluation: These sources (tur.so, crates.io) are official distribution points for the Turso/libSQL project managed by the vendor.
[REMOTE_CODE_EXECUTION]: The skill includes shell piping patterns for CLI installation.
Evidence: curl -sSfL https://get.tur.so/install.sh | bash and iwr https://get.tur.so/install.ps1 -useb | iex.
Evaluation: While these patterns are high-risk in general, they are pointing to official Turso infrastructure (tur.so, agentfs.dev) as documented in their public repositories. Per trust scope rules, these are informative findings for known vendor tools.
[COMMAND_EXECUTION]: The skill documents various CLI commands for database management.
Evidence: turso db create, turso auth login, and agentfs run bash.
Evaluation: These are standard administrative commands for the service described and do not demonstrate unauthorized privilege escalation or persistence patterns.
[INDIRECT_PROMPT_INJECTION]: The skill documents capabilities to ingest external data for vector and full-text search.
Evidence: 06-vector-search.md and 07-full-text-search.md describe workflows for RAG and search.
Sanitization: Documentation examples correctly use parameter binding (? and named placeholders) in TypeScript, Python, and Go to prevent SQL injection and schema confusion.
Capability Tier: The skill is primarily a documentation resource with no autonomous execution of these commands without user context.

turso