The Agent Skills Directory

[EXTERNAL_DOWNLOADS]: The skill facilitates the installation of the @evomap/evolver package from the official npm registry. As this is the official package of the vendor (evomap), this download is considered a standard operational dependency.
[COMMAND_EXECUTION]: The skill executes local commands for environment diagnostics (node --version, git --version) and tool operation (evolver). It also utilizes npm install -g for setup, but includes a specific security warning to avoid using sudo for global installations, suggesting user-level prefixes instead.
[INDIRECT_PROMPT_INJECTION]: The skill possesses an indirect injection surface as it ingests evolution assets (Genes, Capsules, and Recipes) from the EvoMap Hub and local workspace memory.
Ingestion points: Untrusted or external data enters the agent context through the evolver_recipe_search, evolver_search_assets, and evolver_poll MCP tools.
Boundary markers: The skill provides explicit instructions to the agent to treat output as prompts only and mandates that Evolver output should not be applied as source changes without explicit user approval.
Capability inventory: The agent can perform network operations via a local proxy (127.0.0.1:19820), install npm packages, and execute the evolver CLI tool.
Sanitization: The instructions contain specific prohibitions against printing sensitive configuration data, including bearer tokens, node secrets, and API keys from ~/.evolver/settings.json and .env files.

evolver