The Agent Skills Directory

[REMOTE_CODE_EXECUTION]: The skill utilizes npx to download and execute the @useclawlink/cli package directly from the NPM registry during setup and operation.
Evidence: npx @useclawlink/cli login, npx @useclawlink/cli connect kit (SKILL.md)
[COMMAND_EXECUTION]: The skill relies on shell command execution to perform all Kit-related tasks, including retrieving account info, managing subscribers, and listing broadcasts.
Evidence: usage of npx @useclawlink/cli run kit for various action IDs (SKILL.md)
[INDIRECT_PROMPT_INJECTION]: The skill identifies Kit actions by passing natural language user input as an argument to the CLI tool.
Ingestion points: The <what you want to do> argument in the npx @useclawlink/cli actions kit command (SKILL.md).
Boundary markers: The input is enclosed in double quotes, but no explicit instructions are provided to the agent to sanitize or ignore potential commands within the user's data.
Capability inventory: Execution of shell commands via npx, access to local credentials in ~/.clawlink/credentials.json, and modification of Kit marketing data.
Sanitization: No input validation or sanitization steps are defined for the dynamic string passed to the CLI.

kit