The Agent Skills Directory

[COMMAND_EXECUTION]: The skill provides instructions to execute shell commands using curl for credential validation and uvx for running the empty-hass testing utility.
[EXTERNAL_DOWNLOADS]: The skill guides users to download and install third-party libraries from official registries (npm, pip) and executes a utility directly from a GitHub repository (github.com/balloob/empty-hass). These are standard development practices and the GitHub resource is owned by the skill author.
[INDIRECT_PROMPT_INJECTION]: The skill possesses an attack surface for indirect prompt injection as it ingests and processes data from external sources.
Ingestion points: User-provided Home Assistant URL, Long-Lived Access Token, and raw JSON responses from the Home Assistant API (e.g., entity lists, configuration data) retrieved in SKILL.md.
Boundary markers: The skill does not define specific delimiters or instructions to ignore potential commands embedded in the Home Assistant API responses.
Capability inventory: The skill enables network operations via curl and generated code in references/python_api.md and references/node_api.md, as well as potential file system interactions through integration.
Sanitization: The skill provides logic for URL normalization in SKILL.md but does not specify sanitization for data retrieved from the Home Assistant instance API.

home-assistant