The Agent Skills Directory

[EXTERNAL_DOWNLOADS]: The skill utilizes npx @useclawlink/cli to download and execute the ClawLink CLI tool from the NPM registry. This package is an official resource from the skill's author (clawlink-hq) and is required for the integration to function.
[COMMAND_EXECUTION]: The skill executes shell commands to interact with the TickTick API. It manages its own authentication state by storing credentials at ~/.clawlink/credentials.json. This path is specific to the tool's operations and does not involve accessing system-level secrets (like SSH keys or AWS configs).
[INDIRECT_PROMPT_INJECTION]: The skill provides an interface where natural language input is used to determine and execute actions within TickTick, which is a potential surface for indirect instructions to be processed by the agent.
Ingestion points: The natural language string argument passed to npx @useclawlink/cli actions ticktick "<what you want to do>" in SKILL.md.
Boundary markers: The instructions use standard shell quoting for the input but lack explicit delimiting or instructions for the LLM to ignore potentially malicious embedded content within the user-provided string.
Capability inventory: The CLI tool can read data from TickTick, describe API inputs, and execute state-changing actions (writes) via the run command.
Sanitization: The skill does not demonstrate explicit validation or filtering of the natural language input before passing it to the CLI; however, it explicitly instructs the agent to confirm with the user before performing any write operations.

ticktick