The Agent Skills Directory

[EXTERNAL_DOWNLOADS]: The skill fetches a JSON support advisory from the vendor's repository on GitHub (raw.githubusercontent.com/Frappucc1no/recall-loom/main/release-advisory.json) to check for package updates and support status.\n- [COMMAND_EXECUTION]: In scripts/core/coldstart/sources.py, the skill executes 'git log' to extract recent commit subjects. This is a legitimate operation used to gather project history signals when a new context is being established.\n- [INDIRECT_PROMPT_INJECTION]: The skill processes project documentation and logs which may contain untrusted data. This attack surface is proactively mitigated by a dedicated safety scanner (scripts/core/safety/attached_text.py) that filters out instruction-override patterns and sensitive data dumps before they are incorporated into project memory.\n- [DYNAMIC_CONTEXT_INJECTION]: In native_commands/, the skill provides templates for host environments (like Claude Code) that use the '!command' syntax. These templates are used strictly to route high-level commands (like rl-init) to the skill's own dispatcher script. The installation script (scripts/install_native_commands.py) includes specific validation logic to ensure that only safe, relative project paths are used in these wrappers.

recallloom