The Agent Skills Directory

[EXTERNAL_DOWNLOADS]: The skill utilizes npx to download and run the @useclawlink/cli package from the NPM registry. This package is the official tool provided by the vendor (ClawLink) to facilitate secure service connections.
[COMMAND_EXECUTION]: The skill relies on shell command execution to perform all its core functions, including authentication, service connection, and data retrieval from Yandex services.
[INDIRECT_PROMPT_INJECTION]: The skill interacts with external data from Yandex services, representing a potential surface for indirect injection if that data contains malicious instructions.
Ingestion points: API responses from Yandex services such as yandex_get_public_resource and yandex_get_genres described in SKILL.md.
Boundary markers: The skill does not define specific boundary markers or "ignore" instructions for the agent when processing data returned by the CLI tool.
Capability inventory: The agent can execute shell commands through the @useclawlink/cli tool as documented in SKILL.md.
Sanitization: There are no explicit instructions for sanitizing or validating the data returned from Yandex before processing it.
[CREDENTIALS_UNSAFE]: The skill documents the storage of credentials in a local file at ~/.clawlink/credentials.json. This is standard credential management for CLI tools and does not constitute a security risk such as hardcoding secrets.

yandex