The Agent Skills Directory

[REMOTE_CODE_EXECUTION]: The skill provides instructions to execute a shell script directly from a remote URL using the curl -fsSL ... | bash pattern. This method of installation and upgrade is used to set up the toolkit and its short alias. Additionally, the skill suggests using npx to fetch and run the skills utility for adding components from a remote repository. These patterns bypass standard package verification and integrity checks.
[EXTERNAL_DOWNLOADS]: The skill fetches content from external sources, specifically shell scripts hosted on GitHub's raw content domain and packages from the npm registry via npx.
[COMMAND_EXECUTION]: The instructions rely heavily on executing shell commands to configure the environment, including modifying the system PATH, running build processes with make, and using specialized CLI tools (fmtk, flutter) to perform system checks and requests.
[INDIRECT_PROMPT_INJECTION]: The skill possesses an indirect prompt injection surface as it is designed to ingest and act upon the output of external tools, such as JSON data from fmtk doctor.
Ingestion points: The agent is instructed to read and interpret the results of fmtk doctor --json and fmtk exec commands.
Boundary markers: There are no explicit delimiters or instructions provided to the agent to treat the command output as untrusted data.
Capability inventory: The skill has the capability to execute shell commands, perform network requests via curl, and modify environment variables based on the ingested data.
Sanitization: No sanitization or validation of the tool outputs is specified before the agent processes them.

flutter-mcp-toolkit-setup