The Agent Skills Directory

[REMOTE_CODE_EXECUTION]: The skill automates the installation of agent extensions from external repositories. It utilizes npx skills add to fetch and execute code from GitHub and git submodule to link external projects. While it targets vendor-owned repositories by default, it is designed to handle arbitrary external sources.
[COMMAND_EXECUTION]: Several bundled Python scripts (add_reference_repo.py, refresh_cache.py, sync_skills_sh.py) execute shell commands via subprocess.run to manage the local environment and Git state, including the modification of Git protocol settings.
[INDIRECT_PROMPT_INJECTION]: The skill possesses a surface for indirect injection attacks.
Ingestion points: The agent is instructed to recursively scan and read SKILL.md files from local directories and external submodules to populate its cache and perform audits.
Boundary markers: No explicit delimiters or isolation mechanisms are defined for processing the content of external skill files.
Capability inventory: The skill can execute shell commands (git, npx), perform network operations (via npx and git), and write files to the local system.
Sanitization: The skill relies on the agent's own 'semantic judgment' and 'Privacy Audit' rules to detect malicious content, rather than automated validation.
[DATA_EXFILTRATION]: The 'Privacy Audit' feature explicitly directs the agent to locate and analyze sensitive information such as API keys, tokens, and PII within the repository. While designed as a security check to block accidental data exposure before a Git push, this capability involves processing sensitive data which could be targeted by injection attacks.

skill-repo-manager