The Agent Skills Directory

[COMMAND_EXECUTION]: The skill executes various system and application commands to manage installations, including dsh plugin add, ha daemon status, and npm run build. These commands interact with local application runtimes and the filesystem.
[EXTERNAL_DOWNLOADS]: The skill utilizes npm exec --yes to fetch and execute the semver package from the official npm registry. It also initiates build processes that depend on external package registries for dependency resolution.
[DYNAMIC_EXECUTION]: The skill uses node -e to execute inline JavaScript for reading the user's filesystem, specifically to discover DSH profiles in ~/.dsh/profiles. It also executes a local maintenance script (sync-runtime-skills.mjs) from a dynamically resolved source directory.
[INDIRECT_PROMPT_INJECTION]: The skill exhibits an attack surface for indirect injection by ingesting and acting upon untrusted data from local configuration files (package.json, cordis.patch.yml) and directory structures.
Ingestion points: Reads metadata from package.json and cordis.patch.yml within the source directory.
Boundary markers: Includes instructions to exclude credentials from output and avoid overwriting existing user profiles.
Capability inventory: Includes command execution (dsh, ha), build processes (npm run build), and file synchronization via a local node script.
Sanitization: No explicit sanitization or validation of the content of the ingested configuration files is mentioned before processing.

harness-dsh-install