The Agent Skills Directory

[EXTERNAL_DOWNLOADS]: The skill uses npx to download and run the @useclawlink/cli package from the public NPM registry. This package is the official tool provided by the vendor, clawlink-hq, to facilitate the integration.
[REMOTE_CODE_EXECUTION]: The instructions command the agent to execute shell commands using npx @useclawlink/cli, which involves fetching and running remote code from the NPM registry to perform login and data synchronization tasks.
[COMMAND_EXECUTION]: The skill relies on shell command execution to interact with the Zoho Invoice service through the ClawLink CLI, including commands for authentication (login), connection (connect), and executing actions (run).
[INDIRECT_PROMPT_INJECTION]: The skill processes data fetched from Zoho Invoice, which represents an attack surface where untrusted data could influence agent behavior.
Ingestion points: Data is ingested from Zoho Invoice via the actions and run commands executed by the agent as described in SKILL.md.
Boundary markers: The skill documentation includes a manual verification step, advising the agent to "confirm with the user before any write."
Capability inventory: The skill possesses the capability to execute shell commands via npx and perform network operations through the vendor CLI.
Sanitization: There is no explicit mention of sanitization or filtering of the content retrieved from Zoho Invoice before it is processed by the AI agent.

zoho-invoice