The Agent Skills Directory

[EXTERNAL_DOWNLOADS]: The install.sh script performs a global installation of the mex-agent package via npm install -g. It also uses npx to register the skill from the author's GitHub repository (https://github.com/akillness/jeo-skills).
[COMMAND_EXECUTION]: The skill relies on several shell commands (mex setup, mex graph, mex check) to function. It includes a verify_mex_agent function that validates the version string of the mex binary to prevent name collisions with unrelated system tools such as TeX Live's mex utility.
[INDIRECT_PROMPT_INJECTION]: This skill is designed to ingest codebase information and present it to an AI agent for documentation purposes, which creates a potential surface for indirect injection if malicious instructions are embedded in the repository being analyzed.
Ingestion points: Local repository source files and directory structures processed by mex graph (SKILL.md, scripts/install.sh).
Boundary markers: The skill uses explicit "COPY ABOVE/BELOW THIS LINE" banners to separate tool-generated instructions from user data.
Capability inventory: The agent is granted Read, Write, Edit, and Bash capabilities which allow it to modify the local filesystem based on the processed data.
Sanitization: No explicit sanitization or filtering of the codebase content is described before it is interpolated into agent prompts.
[SAFE_PRACTICE]: The documentation provides clear information regarding telemetry, noting that it is enabled by default and detailing how users can opt-out using the DO_NOT_TRACK or MEX_TELEMETRY environment variables.

mex