The Agent Skills Directory

[EXTERNAL_DOWNLOADS]: The skill uses npx --yes skills to download and execute a package from the npm registry. While npm is a well-known service, executing remote code is a significant capability.
[COMMAND_EXECUTION]: Utilizes shell commands including npx, jq, and test to perform file system operations, check lock files, and manage skill symlinks in ~/.agents/ and ~/.claude/.
[PROMPT_INJECTION]: Vulnerable to indirect prompt injection (Category 8) because it processes untrusted metadata from external skill sources.
Ingestion points: Reads descriptions and instructions from SKILL.md files and listing output from npx skills add <source> --list (SKILL.md).
Boundary markers: Absent. The instructions do not specify delimiters or warnings to ignore embedded instructions in the ingested content.
Capability inventory: The agent has the ability to run shell commands via npx and write to the file system (SKILL.md).
Sanitization: Absent. Metadata from external sources is summarized and used to drive user choices without escaping or validation.

install-skills