The Agent Skills Directory

[EXTERNAL_DOWNLOADS]: Fetches upstream skill content and metadata from public repositories.
Evidence: catalog.json and scripts/catalog.py facilitate fetching content from the Cursor (github.com/cursor/plugins.git) and Matt Pocock (github.com/mattpocock/skills.git) repositories to compare against local versions.
[COMMAND_EXECUTION]: The skill executes various local tools and scripts to perform its maintenance tasks.
Evidence: scripts/catalog.py uses subprocess.run to execute git commands for revision comparison, path validation, and history inspection.
Evidence: MAINTENANCE.md and VALIDATION.md specify the execution of development tools including pnpm fmt:check, npx skills, bun test, and gitleaks.
[INDIRECT_PROMPT_INJECTION]: The skill processes instructions and metadata from other skills, including those fetched from external repositories, creating a surface for embedded instructions to influence the agent's behavior during review or repair.
Ingestion points: The skill reads SKILL.md files and associated documentation from local and upstream repositories using scripts/catalog.py.
Boundary markers: No specific markers or warnings are employed to isolate untrusted content during the maintenance and review process.
Capability inventory: The skill has the ability to read and write files and execute shell commands through catalog.py and other developer utilities.
Sanitization: Content from analyzed skills is read and processed without explicit sanitization or escaping of potentially malicious embedded instructions.

maintain-skills