The Agent Skills Directory

[COMMAND_EXECUTION]: The skill executes various system commands to prepare the environment, including checking tool versions (node, npm, git), cloning source code, building the daemon component (npm run build), and running Node.js scripts for skill synchronization.
[EXTERNAL_DOWNLOADS]: The skill downloads the primary 'Harness Anything' source code from the author's repository at https://github.com/FairladyZ625/harness-anything.git. It also references documentation and guidelines from Vercel Labs' public repositories and the official Bun service.
[REMOTE_CODE_EXECUTION]: The installation process involves executing scripts downloaded from the remote repository, such as tools/sync-runtime-skills.mjs and the CLI entry point at packages/cli/src/index.ts, to link skills to the user's agent and initialize the workspace.
[INDIRECT_PROMPT_INJECTION]: The skill operates as a multi-step chain that reads instructions from external data.
Ingestion points: It explicitly reads and follows instruction sets from external files downloaded at runtime, specifically harness-install/SKILL.md and harness-ceo/SKILL.md.
Boundary markers: There are no explicit boundary markers or warnings mentioned to distinguish between the skill's own instructions and potentially adversarial instructions embedded in the downloaded files.
Capability inventory: The skill has access to shell execution and file system write operations, which are used to implement the instructions found in the external files.
Sanitization: The skill does not describe any sanitization or validation logic for the content of the externally-loaded skill files before they are processed by the agent.

harness-download