The Agent Skills Directory

[EXTERNAL_DOWNLOADS]: The skill instructs the agent to download and execute the @useclawlink/cli package from the NPM registry. This package is a vendor-provided tool necessary for managing the Zoho Books connection and performing actions.\n- [REMOTE_CODE_EXECUTION]: The skill utilizes npx to download and run the @useclawlink/cli tool at runtime. This allows for the execution of remote code contained within the package.\n- [COMMAND_EXECUTION]: The skill involves running several shell commands to manage authentication and interact with Zoho Books data. Subcommands include login, connect, actions, describe, and run.\n- [INDIRECT_PROMPT_INJECTION]: The skill processes user-supplied strings and data through shell command arguments, which could serve as a vector for indirect prompt injection.\n
Ingestion points: User instructions and JSON input are passed as arguments to the actions and run commands in SKILL.md.\n
Boundary markers: The instructions include a specific safety protocol requiring the agent to confirm with the user before executing any write operations.\n
Capability inventory: The skill allows the agent to read and modify data in Zoho Books (e.g., creating contacts, expenses, and invoices) via the vendor CLI.\n
Sanitization: The skill instructions do not specify any explicit validation or sanitization of the input strings before they are incorporated into the shell commands.

zoho-books