The Agent Skills Directory

[EXTERNAL_DOWNLOADS]: The skill uses uvx showboat to download the showboat package from the Python Package Index (PyPI). It also references installation instructions for the uv tool from Astral's official documentation at https://docs.astral.sh/uv/getting-started/installation/.
[REMOTE_CODE_EXECUTION]: When invoked with the showboat argument, the skill executes the showboat tool via uvx, which involves downloading and running remote code from an external registry.
[COMMAND_EXECUTION]: The skill utilizes the Bash tool and uvx showboat exec to run shell commands such as find, git log, cat, and sed to explore the repository structure and extract specific code listings.
[INDIRECT_PROMPT_INJECTION]: The skill analyzes and summarizes untrusted codebase data, creating an attack surface where malicious files could influence the agent's behavior. * Ingestion points: SKILL.md (Steps 2 and 3) utilizes Read, Glob, Grep, and git log to ingest data from the local repository. * Boundary markers: The skill defines a rigid markdown template for the output in SKILL.md (Step 4), but lacks explicit 'ignore instructions' directives. * Capability inventory: SKILL.md defines allowed-tools including Read, Glob, Grep, Bash, and Write, plus the capability to execute code via uvx. * Sanitization: No evidence of explicit sanitization or validation of repository data is present in the skill instructions.

orient