The Agent Skills Directory

[COMMAND_EXECUTION]: The skill instructs the agent to execute shell commands to install and configure the Calibrate CLI (brew install, calibrate login, calibrate configure). It also executes a local bash script scripts/find-backend.sh to parse web content.
[EXTERNAL_DOWNLOADS]: The skill uses npx to update itself from a remote registry and uses curl within a script to fetch HTML and JavaScript assets from user-provided URLs to identify backend API hosts. These are performed against both public registries and user-specified self-hosted domains.
[INDIRECT_PROMPT_INJECTION]: The skill processes external data (HTML and JS content) from user-provided web addresses via the find-backend.sh script. While this creates an ingestion surface for potentially malicious content, the script's primary action is string extraction (regex for URLs) rather than direct execution of the content, and it is documented as a discovery helper for self-hosted deployments.
[SAFE]: Instructions to update the skill via npx and installation of the CLI from a specific tap (dalmia/tap/calibrate) are standard operations for this tool's vendor-provided instructions and do not represent malicious behavior in this context.

calibrate-resources