The Agent Skills Directory

[EXTERNAL_DOWNLOADS]: The skill instructs users to download a signing daemon from a custom Homebrew tap (agent-receipts/tap/obsigna) and references external SDKs.
[COMMAND_EXECUTION]: Instructions include the execution of the obsigna-daemon binary and CLI tools like obsigna receipt verify to manage cryptographic audit chains.
[REMOTE_CODE_EXECUTION]: The skill facilitates the installation and execution of code from external registries via npm install @obsigna/sdk-ts and pip install obsigna.
[DATA_EXFILTRATION]: The system records and stores sensitive metadata including user identifiers (humanPrincipal) and detailed tool action logs for audit purposes.
[INDIRECT_PROMPT_INJECTION]: The skill processes untrusted tool execution data which could contain embedded instructions.
Ingestion points: SDK emitter.emit calls and PostToolUse hooks described in SKILL.md.
Boundary markers: Uses structured W3C Verifiable Credential JSON format to delimit data.
Capability inventory: Uses shell execution for daemon management and receipt verification.
Sanitization: No explicit sanitization or filtering is mentioned for the action metadata stored in receipts.

run-receipt