The Agent Skills Directory

[EXTERNAL_DOWNLOADS]: The skill recommends installing a third-party extension from an external repository.
- Evidence: In SKILL.md, the "Technical Writer Skill Synergy" section provides the command npx skills add https://github.com/shubhamsaboo/awesome-llm-apps --skill technical-writer -g -y to install an external skill.
[PERSISTENCE]: The provided documentation samples include instructions for modifying shell configuration files.
- Evidence: references/samples/README.md contains an instruction to append a command to the user's ~/.bashrc file: echo "eval \"\$(direnv hook bash)\"" >> ~/.bashrc.
[PRIVILEGE_ESCALATION]: The documentation samples include commands that require administrative privileges.
- Evidence: references/samples/README.md suggests using sudo to install software: sudo apt install direnv.
[INDIRECT_PROMPT_INJECTION]: The skill processes untrusted project data which creates a vulnerability surface for indirect prompt injection.
- Ingestion points: The agent is instructed to read existing documentation files (e.g., README.md, TODO.md, DESIGN.md) and codebase configuration files (e.g., config.py, Makefile, *.tfvars, pyproject.toml) in the SKILL.md under "Core Principles" and "Document Maintenance Guide".
- Boundary markers: The skill does not define specific delimiters or "ignore" instructions for the content it reads.
- Capability inventory: The skill has the capability to write and modify files in the repository and suggests executing shell commands for skill installation (npx skills add).
- Sanitization: There are no explicit instructions for sanitizing or validating the contents of the read files before they are used to update documentation.

maintaining-core-documentation