The Agent Skills Directory

[COMMAND_EXECUTION]: The helper script scripts/audit-pack.py utilizes the subprocess.run function to execute git commands. This is used exclusively for retrieving repository metadata, such as the current commit hash (rev-parse HEAD) and the remote origin URL (config --get remote.origin.url), ensuring the repository matches the audited snapshot.
[EXTERNAL_DOWNLOADS]: The skill facilitates downloading the official Unity-Technologies/skills repository from GitHub and uses the skills CLI tool via npx. These references target a well-known organization and established developer tools, and the instructions emphasize pinning specific commits to ensure reproducibility and safety.
[INDIRECT_PROMPT_INJECTION]: The skill is designed to ingest and process data from the official Unity repository, including SKILL.md frontmatter and support files.
Ingestion points: Repository metadata and skill definition files parsed by scripts/audit-pack.py and the npx skills CLI.
Boundary markers: The instructions mandate a 'read-only audit' mode to establish a trust boundary before installation and explicitly warn against executing unreviewed upstream code.
Capability inventory: The skill can perform shell commands via git, use the npx package runner, and perform file system operations for installation.
Sanitization: The audit script implements a custom parser to validate skill names and detect malformed frontmatter, blocking installation if anomalies are detected.

unity-technologies-skills