The Agent Skills Directory

[COMMAND_EXECUTION]: The skill instructions direct the agent to execute shell commands for environment setup and operation, including npm install for the CLI and export to modify the shell's PATH variable.
[INDIRECT_PROMPT_INJECTION]: The skill describes an architecture that introduces a surface for indirect prompt injection, particularly as the agent processes output from the CARTO CLI and interacts with the CARTO MCP server, which dynamically registers user-published Workflows as tools.
Ingestion points: The agent ingests data from CLI command responses (SKILL.md), MCP tool outputs, and user-published analytical Workflows (references/access-paths.md).
Boundary markers: While the skill recommends using the --json flag for machine-readable output (SKILL.md), it does not specify explicit delimiters or "ignore instructions" prompts to protect the agent from malicious content embedded in platform data.
Capability inventory: The agent possesses capabilities to install software via npm, perform authentication (carto auth login), and execute destructive operations such as maps delete or workflows delete (SKILL.md, references/global-options.md).
Sanitization: The instructions do not define sanitization or validation logic for data retrieved from external CARTO platform resources.
[CREDENTIALS_UNSAFE]: The skill documents authentication flows involving sensitive credentials, such as API Access Tokens managed via the CARTO_API_TOKEN environment variable or the --token flag, and OAuth authorization codes passed as command arguments during headless login (references/authentication.md, references/global-options.md).
[EXTERNAL_DOWNLOADS]: The skill facilitates the installation of the @carto/carto-cli package from the npm registry to enable platform operations (references/installation.md).

carto-basics