The Agent Skills Directory

[EXTERNAL_DOWNLOADS]: The skill fetches supplementary agent skill definitions from well-known official repositories.
Evidence: Section 2.6 in SKILL.md utilizes curl to download SKILL.md files from URLs specified in assets/catalog.md.
Source Analysis: Downloads originate from official GitHub repositories belonging to Firebase and the skill author's own DevOps organization.
[COMMAND_EXECUTION]: The skill executes a variety of local shell commands to manage the project state and perform environment audits.
Evidence: Runs python3 scripts/resume.py (Section 1.2) to determine the next setup step.
Evidence: Utilizes git init, git status --porcelain, and git ls-files (Section 2.0) to analyze project maturity and file structure.
Evidence: Employs mkdir and curl (Section 2.6) for skill installation and git add, git commit, and git notes (Section 3.0) for version control and metadata tracking.
[PROMPT_INJECTION]: The skill reads untrusted local project files to infer architecture and product vision, which creates an indirect prompt injection surface.
Ingestion points: The skill reads README.md, manifest files (package.json, go.mod, requirements.txt, etc.), and general source code files during the brownfield project scan (Section 2.0).
Boundary markers: Absent. The gathered content is processed and summarized to propose project definitions.
Capability inventory: Git repository management, file system creation/writing, and network downloads via curl.
Sanitization: Absent. The skill instructions rely on the LLM to interpret and summarize the ingested file content without explicit escaping or filtering.

conductor-setup