The Agent Skills Directory

[COMMAND_EXECUTION]: The skill utilizes gh, git, python3, and node commands to fetch upstream changes, manage repository branches, and run internal validation tools.
[EXTERNAL_DOWNLOADS]: The skill fetches an external binary named eyebrow during the synchronization process. It includes instructions to verify the binary against a checksums.txt file to ensure integrity.
[DYNAMIC_EXECUTION]: Local scripts including scripts/aeon_update.py, scripts/validate-skill-packs.mjs, and scripts/validate-config.js are executed to process merges and validate the resulting configuration.
[INDIRECT_PROMPT_INJECTION]: By ingesting code and metadata from upstream repositories via the GitHub API, the skill has an indirect prompt injection surface. This risk is managed by the mandatory manual review of the generated Pull Request and the use of automated validation scripts (e.g., config and skill integrity checkers) before completion.
Ingestion points: GitHub API calls (gh api) fetching upstream repository contents and commit data.
Boundary markers: All synced changes are restricted to a dedicated aeon-update/sync-* branch and surfaced in a Pull Request for manual human review.
Capability inventory: File system writes, git branch management, local script execution (Python/Node), and GitHub API interactions.
Sanitization: Uses git merge-file for 3-way merges to prevent blind overwrites, and employs multiple validators (validate-skill-packs.mjs, validate-config.js) and the eyebrow scanner to check for regressions or capability expansion.

aeon-update