The Agent Skills Directory

[EXTERNAL_DOWNLOADS]: The skill provides instructions to install the @duvoai/cli package from npm (npm install -g @duvoai/cli). This is the official command-line tool provided by the vendor for interacting with their platform.
[COMMAND_EXECUTION]: The skill's primary function is to execute shell commands using the duvo CLI. This allows the agent to automate tasks such as managing agents, starting runs, and interacting with the Duvo API.
[DATA_EXPOSURE]: The instructions describe the resolution and storage of sensitive credentials, including API keys and OAuth profiles. It recommends standard practices such as using environment variables (DUVO_API_KEY) or named profiles stored on disk to manage authentication safely.
[INDIRECT_PROMPT_INJECTION]: The skill processes data from external API endpoints (e.g., via duvo runs list or duvo cases list) which constitutes an attack surface for indirect prompt injection.
Ingestion points: Data enters the agent context through CLI commands that list or get resources (agents, runs, cases, clarity processes) from the Duvo API.
Boundary markers: The instructions do not explicitly mandate the use of boundary markers when the agent processes this external data.
Capability inventory: The agent has the capability to execute shell commands via the duvo CLI, write files via duvo files content-set, and perform arbitrary network requests via the duvo api escape hatch.
Sanitization: There are no specific instructions regarding the sanitization of data retrieved from the API before it is processed by the agent.

duvo-cli