The Agent Skills Directory

[REMOTE_CODE_EXECUTION]: The documentation provides specific commands to download and execute shell (.sh), batch (.bat), and Python (.py) scripts directly from the vendor's repository on GitHub. While the documentation provides a security warning and instructions to inspect the content before execution, the use of curl|bash and similar patterns remains a significant attack vector. Evidence: Unix, Windows, and Python installation commands in SKILL.md targeting https://raw.githubusercontent.com/cycleuser/Skills/main/.
[INDIRECT_PROMPT_INJECTION]: The skill's primary function involves scanning the workspace and project directories for SKILL.md files to register and load instructions into the agent's context. This mechanism lacks explicit boundary markers or sanitization, creating a surface where untrusted or malicious files introduced into the filesystem could influence the agent's behavior.
Ingestion points: .opencode/skills/, project/.opencode/skills/, and project/.codex/skills/ (defined in SKILL.md).
Boundary markers: Absent.
Capability inventory: The manager activates rule files and returns skill context to the session, potentially enabling commands like /skill load and /skill reload to trigger instructions defined in discovered files.
Sanitization: Absent.
[COMMAND_EXECUTION]: The skill facilitates the execution of system-level commands through its installation instructions and management functions, such as /skill reload, which performs directory scanning and file extraction. Evidence: Installation scripts and registry update logic described in SKILL.md and README.md.
[EXTERNAL_DOWNLOADS]: Fetches configuration and installation scripts from external URLs. These resources are identified as vendor-owned by cycleuser and are considered functional for this specific tool, but are documented here as external dependencies. Evidence: GitHub URLs for quick-install.sh, quick-install.bat, and install.py in SKILL.md.

skill-manager