The Agent Skills Directory

[EXTERNAL_DOWNLOADS]: The skill downloads source code from external Git repositories using git clone (SKILL.md, Step 4). While it defaults to HTTPS URLs from well-known services like GitHub or GitLab, it allows cloning from any user-approved repository.
[COMMAND_EXECUTION]: Executes Git commands directly in the shell, including git ls-remote for ref verification, git clone for fetching source code, and git remote get-url for repository validation (SKILL.md, Step 4).
[INDIRECT_PROMPT_INJECTION]: The skill ingests external, third-party source code into the agent's context, which can contain malicious instructions.
Ingestion points: Cloned code is stored in .slim/clonedeps/repos/ and is explicitly made visible to the agent by adding inclusion rules to the .ignore file (SKILL.md, Step 6).
Boundary markers: Absent. There are no instructions to the agent to treat the content of the cloned repositories as untrusted data or to ignore potential instructions embedded within them.
Capability inventory: The skill possesses the ability to write to project configuration files (.slim/clonedeps.json, .gitignore, .ignore, AGENTS.md) and perform network operations via Git (SKILL.md, Steps 4-7).
Sanitization: Absent. The content of the external source repositories is not sanitized or filtered before being presented to the agent for inspection.

clonedeps