The Agent Skills Directory

[EXTERNAL_DOWNLOADS]: The skill fetches part metadata and binary STEP files from the official vendor API at api.step.parts. This is the intended functionality for CAD component discovery.
[COMMAND_EXECUTION]: An included Python script (scripts/download_step_part.py) is used to perform searches and manage the download process. The script uses only standard library modules and follows secure coding practices.
[INDIRECT_PROMPT_INJECTION]: The skill ingests untrusted data from an external API. It includes several defensive measures to mitigate injection and exploitation risks:
Ingestion points: Data enters the system via JSON responses from api.step.parts processed by the download script.
Boundary markers: Skill instructions explicitly command the agent to treat catalog records and descriptions as data for verification only, never as instructions.
Capability inventory: The skill can perform network requests and write files to the local file system.
Sanitization: The download script strictly sanitizes filenames provided by the API to prevent path traversal, restricts network protocols to HTTPS, and performs mandatory SHA-256 checksum verification on all downloaded assets.

step-parts