The Agent Skills Directory

[COMMAND_EXECUTION]: The skill uses the Bash tool to execute a variety of native binaries including ogr2ogr, tippecanoe, duckdb, jq, and git. These commands are used to process geospatial data, manage LFS tracking, and interact with repository configurations.
[EXTERNAL_DOWNLOADS]: The skill performs network operations to harvest data.json catalogs and paged features from ArcGIS REST APIs. It also references cloning the felt/tippecanoe repository within a GitHub Actions workflow context for build purposes.
[INDIRECT_PROMPT_INJECTION]: The skill ingests untrusted metadata and geospatial data from external ArcGIS Hub sites. While it includes metadata sanitization steps (e.g., 'sanitized metadata', 'cleaned display title'), the ingestion of remote content into a processing pipeline represents an attack surface for indirect injection.
Ingestion points: Remote ArcGIS Hub /data.json inventory and FeatureService REST API endpoints.
Boundary markers: The skill processes data through specialized binaries (jq, ogr2ogr) which act as structural boundaries, though specific delimiters for the LLM context are not explicitly defined in the prompts.
Capability inventory: Includes shell command execution (Bash), local file system writes, and network fetching (WebFetch, curl).
Sanitization: Implements cleaning of display titles and sanitization of metadata fields (license, description) before inclusion in the portal catalog.
[CREDENTIALS_UNSAFE]: The skill refers to a PORTALJS_TOKEN used for Git-LFS authentication. The documentation follows security best practices by recommending the use of environment variables and platform-specific secret management (e.g., GitHub Secrets) rather than hardcoding credentials.

arcgis-to-portaljs