The Agent Skills Directory

[COMMAND_EXECUTION]: The skill includes a utility script that executes shell commands to manage its ecosystem components.
Evidence: subprocess.run([npx, *command(s)[1:]], env=os.environ.copy()) in scripts/install_all.py.
[EXTERNAL_DOWNLOADS]: The skill facilitates the download of ecosystem member skills from the vendor's repository.
Evidence: scripts/install_all.py triggers npx skills add fatih-developer/fth-skills to install missing member skills.
[INDIRECT_PROMPT_INJECTION]: The skill processes data handoffs from other skills, establishing a potential vector for indirect prompt injection if a member skill's output is manipulated.
Ingestion points: references/handoff-contract.md specifies reading machine-readable artifacts from the file system or inline JSON blocks.
Boundary markers: The handoff contract explicitly instructs skills to verify inputs rather than treating them as absolute ground truth.
Capability inventory: The skill has the ability to execute shell commands via the ecosystem installation script.
Sanitization: No specific input sanitization for handoff data is provided in the skill logic.

ecosystem-product