The Agent Skills Directory

[COMMAND_EXECUTION]: The skill uses the @useclawlink/cli tool via shell commands (npx) to perform authentication and registry operations such as login, connect, and run.
[EXTERNAL_DOWNLOADS]: The skill relies on the @useclawlink/cli package downloaded from the NPM registry. This package is managed by the skill's authoring organization.
[REMOTE_CODE_EXECUTION]: Usage of npx to download and execute the ClawLink CLI represents remote code execution of a vendor-provided tool.
[PROMPT_INJECTION]: The skill exposes an indirect prompt injection surface by retrieving and processing external data from the public NPM registry.
Ingestion points: Data is ingested from the NPM registry via actions such as npm_registry_get_package, npm_registry_search_packages, and npm_get_registry_changes as described in SKILL.md.
Boundary markers: Absent; there are no instructions provided to the agent to isolate or ignore potentially malicious content embedded in package metadata or registry feeds.
Capability inventory: The agent has the capability to execute shell commands using the npx @useclawlink/cli tool for both read and write operations.
Sanitization: Absent; the skill does not define any sanitization, filtering, or validation steps for the data fetched from the registry before it is processed by the agent.

npm